Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-47139
8.6 HIGH
- CVSS version (CVSS): 3.1
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Privileges Required (PR): None (N)
- User Interaction (UI): None (N)
- Scope (S): Changed (C)
- Confidentiality (C): High (H)
- Integrity (I): None (N)
- Availability (A): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Privileges Required (MPR): None (N)
- Modified User Interaction (MUI): None (N)
- Modified Confidentiality (MC): High (H)
- Modified Scope (MS): Changed (C)
- Modified Integrity (MI): None (N)
- Modified Availability (MA): None (N)
Activity log
- Created suggestion
vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as _http_client and _http_server. These are not blocked when the public modules are excluded. Sandboxed code can use these internal builtins to make outbound HTTP requests and open listening HTTP sockets even though the public network modules are denied. This issue has been patched in version 3.11.4.
References
-
https://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p exploitx_refsource_CONFIRM
-
https://github.com/patriksimek/vm2/releases/tag/v3.11.4 x_refsource_MISC
Affected products
vm2
- ==< 3.11.4
Package maintainers
-
@ajs124 Andreas Schrägle <nix@ajs124.de>
-
@7c6f434c Michael Raskin <7c6f434c@mail.ru>