CVE-2026-47139: vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

Synopsis

This is a sandbox escape (network isolation bypass) in vm2, a Node.js sandboxing library. Untrusted code running inside a vm2 NodeVM sandbox can reach underscore-prefixed internal Node.js HTTP builtins (_http_client, _http_server) that are not blocked when the public network modules (http, https, net, etc.) are explicitly excluded. Successful exploitation allows sandboxed code to make outbound HTTP requests and open listening sockets on the host, bypassing the intended network isolation entirely. No fix version has been published upstream yet; HarborGuard is tracking the advisory for patch availability.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to supply or influence code executed inside the vm2 sandbox, which is typically reached over the network in services that accept and run untrusted user-supplied scripts.

• AuthenticationNot required

  No credentials are needed; the CVSS vector specifies PR:N, meaning any caller who can submit code to the sandbox can trigger the bypass.

• Victim interactionNot required

  No human interaction is required; the attacker submits malicious code directly to the sandbox execution path without any victim needing to take an action.

• Attack complexityDetail

  Attack complexity is low (AC:L), meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions beyond access to the sandbox input.

Blast Radius

• Sandboxed code makes outbound HTTP requests to arbitrary external hosts, exfiltrating data or reaching internal network services that the sandbox was meant to be isolated from.
• Sandboxed code opens a listening HTTP socket on the host process, potentially exposing an unintended endpoint to other network-reachable parties.
• The CVSS confidentiality impact is High with a Changed scope (S:C), meaning the bypass extends beyond the sandbox boundary and allows reading of data accessible to the host Node.js process.
• Integrity and availability of the host are not directly impacted per the CVSS vector, but the network exfiltration path can be used to leak secrets, tokens, or internal service responses.