Vulnerability in Patriksimek Vm2

CVE-2026-47141

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are…

EPSS: 0.003 (23.1th percentile) — read the EPSS interpretation.