Incomplete List of Disallowed Inputs Affecting org.webjars.npm:vm2 package, versions [0,]
Threat Intelligence
Snyk has a proof-of-concept or detailed explanation of how to exploit this vulnerability.
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-JAVA-ORGWEBJARSNPM-17111340
- published1 Jun 2026
- disclosed29 May 2026
- creditspbavarva
Introduced: 29 May 2026
NewCVE-2026-47141 (opens in a new tab)How to fix?
A fix was pushed into the master branch but not yet published.
Overview
org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Incomplete List of Disallowed Inputs via the NodeVM builtin allowlist in lib/builtin.js. An attacker can read host-process state by supplying a sandbox require() for diagnostics_channel, async_hooks, perf_hooks, or v8, then using their observability APIs to exfiltrate HTTP request headers, async-context data, performance marks, or the full V8 heap. This affects sandboxes that expose builtin: ['*'] or explicitly allow these modules, letting untrusted code recover secrets and internal application data that the embedder processes in the same Node.js instance.