{
  "threat_severity" : "Moderate",
  "public_date" : "2026-06-12T14:15:44Z",
  "bugzilla" : {
    "description" : "vm2: vm2: Sandbox escape via internal HTTP built-ins leading to network restriction bypass",
    "id" : "2488387",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2488387"
  },
  "cvss3" : {
    "cvss3_base_score" : "8.6",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
    "status" : "verified"
  },
  "cwe" : "CWE-1100",
  "details" : [ "vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration direct access to http, https, http2, net, dgram, tls, dns, and dns/promises is blocked. However, Node.js also exposes underscored internal HTTP builtins such as _http_client and _http_server. These are not blocked when the public modules are excluded. Sandboxed code can use these internal builtins to make outbound HTTP requests and open listening HTTP sockets even though the public network modules are denied. This issue has been patched in version 3.11.4.", "A flaw was found in vm2, a Node.js sandbox. This vulnerability allows sandboxed code to bypass network restrictions by utilizing internal HTTP built-ins, such as _http_client and _http_server. An attacker can exploit this to make outbound HTTP requests or open listening HTTP sockets, even when public network modules are explicitly denied. This could lead to unauthorized information disclosure or further compromise of the system." ],
  "statement" : "This vulnerability has been rated as Moderate for Red Hat Developer Hub and Red Hat Ansible Automation Platform. The vm2 sandbox exists as a transitive dependency in Red Hat Developer Hub and is only utilized during build time. The sandbox is therefore not exposed on the production code path. Exploitation of this vulnerability requires attackers to access internal HTTP built-ins which is not possible in the default configuration of Red Hat Developer Hub.",
  "affected_release" : [ {
    "product_name" : "Red Hat Developer Hub 1.10",
    "release_date" : "2026-07-08T00:00:00Z",
    "advisory" : "RHSA-2026:36754",
    "cpe" : "cpe:/a:redhat:rhdh:1.10::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1783448184"
  }, {
    "product_name" : "Red Hat Developer Hub 1.9",
    "release_date" : "2026-06-30T00:00:00Z",
    "advisory" : "RHSA-2026:33574",
    "cpe" : "cpe:/a:redhat:rhdh:1.9::el9",
    "package" : "rhdh/rhdh-hub-rhel9:1782761244"
  } ],
  "package_state" : [ {
    "product_name" : "Self-service automation portal 2",
    "fix_state" : "Affected",
    "package_name" : "ansible-automation-platform/automation-portal",
    "cpe" : "cpe:/a:redhat:ansible_portal:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-47139\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-47139\nhttps://github.com/patriksimek/vm2/commit/436053e30eecbabd487e2fd2959c137ac34e2bb1\nhttps://github.com/patriksimek/vm2/releases/tag/v3.11.4\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-r9pm-gxmw-wv6p" ],
  "name" : "CVE-2026-47139",
  "mitigation" : {
    "value" : "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
    "lang" : "en:us"
  },
  "csaw" : false
}