---
title: "GHSA-m5w8-4gq2-6f8x: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)"
url: https://erroneo.us/security/ghsa/GHSA-m5w8-4gq2-6f8x/
description: "GHSA-m5w8-4gq2-6f8x (critical, npm): vm2: NodeVM builtin: [''] exposes os and dns — process-wide observability reads AND writes that hijack the host…"
type: advisory
section: "Security Digest"
date_published: 2026-08-17
date_modified: 2026-08-17
publisher: erroneo.us
author: erroneo.us Security Desk
ghsa: "GHSA-m5w8-4gq2-6f8x"
license: All rights reserved. Quote with attribution and a link.
---

# GHSA-m5w8-4gq2-6f8x: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

## Affected packages

- npm `vm2` <= 3.11.5 → fixed: 3.11.6

## Details

NodeVM builtin: [''] exposes os and dns — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) chained with CWE-732 (Incorrect Permission Assignment for Critical Resource) and CWE-285 (Improper Authorization) — same class the maintainer codified as Defense Invariant #13 in lib/builtin.js and as Category 35 / GHSA-9g8x in docs/ATTACKS.md. CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L → 9.3 (Critical) (Scope = Changed because the data being read and the state being written both belong to the host process, not the sandbox. Confidentiality = High because os.userInfo() returns host UID/GID/username/homedir + os.networkInterfaces() returns the full host network topology including container/VM interfaces with IPs and MAC addresses. Integrity = High because dns.setServers() is a process-wide write that hijacks every subsequent DNS lookup the host makes — including outbound HTTP, telemetry, npm/registry, and any host code that uses fetch or URL-based fs paths. Privileges Required = None because the attacker controls sandbox code, which is the threat model NodeVM exists to mitigate.) Summary GHSA-9g8x-92q2-p28f closed the "process-wide observability builtins" class by adding diagnosticschannel, asynchooks, perfhooks, and v8 to DANGEROUSBUILTINS in lib/builtin.js. The fix's rationale (in the commit message and docs/ATTACKS.md Category 35) is general: > Process-wide observability builtins. Unlike most Node builtins, these expose state of the entire host process rather than sandbox-local state — the vm2 boundary cannot usefully contain them because the data they surface […] belongs to the embedder. Even a readonly proxy that forwards every call to the host module is a working host-data exfiltration primitive. Two builtins satisfying the same description were not added: os and dns. Both are reachable today under the documented builtin: [''] configuration; both expose host-process state that the vm.readonly() proxy cannot localise; and both have write APIs that mutate global host-process state from the sandbox (os.setPriority(), dns.setServers(), dns.setDefaultResultOrder()). dns.setServers() in particular turns sandbox code into a process-wide DNS…

## Sources

- [GitHub Advisory GHSA-m5w8-4gq2-6f8x](https://github.com/advisories/GHSA-m5w8-4gq2-6f8x)
- [github.com](https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x)
- [github.com](https://github.com/patriksimek/vm2/releases/tag/3.11.6)

---
Source page: https://erroneo.us/security/ghsa/GHSA-m5w8-4gq2-6f8x/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt