AIKIDO-2026-920930

TL;DR

vm2's NodeVM uses a hard denylist of builtin modules that must not reach the sandbox even when the module allowlist is *. The denylist omits child_process, so guest code that requests it through *, an explicit entry, or the node: spelling gets the real host module. A single execSync call then runs arbitrary commands on the host, leading to a sandbox escape. The fix adds child_process to the dangerous builtins denylist so it is refused under the wildcard and on explicit request.