Incomplete List of Disallowed Inputs Affecting org.webjars.npm:vm2 package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGWEBJARSNPM-17111173
- published1 Jun 2026
- disclosed29 May 2026
- creditspbavarva, VladimirEliTokarev
Introduced: 29 May 2026
NewCVE-2026-47140 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the builtin allowlist handling in lib/builtin.js. An attacker can reach host code by requiring process and calling getBuiltinModule('child_process'), or by requiring inspector/promises and using Session().post('Runtime.evaluate', ...) to execute JavaScript in the host realm. This lets sandboxed code bypass the intended built-in restrictions and obtain host process execution capabilities, leading to arbitrary command execution and full compromise of the sandboxed application.