NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

Summary

NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspector.

However, the denylist misses process and inspector/promises. Both can be used from sandboxed code to reach host-side execution primitives.

This allows sandboxed code to bypass the intended builtin restrictions and execute code in the host process.

Details

The dangerous builtin denylist is defined in lib/builtin.js. This list does not include:

process
inspector/promises

Non-denied builtins are exposed to the sandbox through:

builtins.set(key, special ? special : vm => vm.readonly(hostRequire(key)));

Because of this, sandboxed code can bypass the expected restrictions in two ways:

1. require('process').getBuiltinModule('child_process') reloads child_process, even when child_process is excluded.
2. require('inspector/promises') exposes the Inspector protocol and can call Runtime.evaluate in the host process.

PoC

Tested on:

vm2: 3.11.2
Node.js: v25.9.0

Run from the vm2 repository root:

node poc/dangerous-builtin-denylist-rce.js

dangerous-builtin-denylist-rce.js

The PoC first confirms the intended restrictions work:

require("inspector"): BLOCKED
require("child_process"): BLOCKED

Then it bypasses them:

require("process").getBuiltinModule("child_process").execFileSync(...)

This spawns a host child process. It also confirms:

require("inspector/promises").Session().post("Runtime.evaluate", ...)

This evaluates JavaScript in the host process.

<img width="858" height="766" alt="Screenshot 2026-05-10 at 11 53 33 AM" src="https://github.com/user-attachments/assets/7614aecb-5ffd-4c41-bfe8-e1fcb3b1bb59" />

Impact

An attacker who can run untrusted JavaScript inside with affected builtin settings can escape the sandbox and execute arbitrary code in the host process.