# Sandbox denylist bypass via omitted module

Denylist of module names instead of allowlist; check omitted, underscored, subpath and meta modules

_Area: Memory corruption and native code. Seen in 3 disclosed reports; latest 2026-08-17. Updated 2026-10-24._

## How it works
A sandbox decides what code may reach by listing modules to block (a denylist) rather than listing what is safe (an allowlist). The assumption that breaks: that the denylist is complete. Any module the author forgot, or did not know existed, is admitted by default. Because the runtime's module namespace is larger than the names a maintainer thinks of, the denylist is almost always incomplete, and the gap is reachable from sandboxed code.

## Where it shows up
- A `DANGEROUS_BUILTINS`-style set filtered against a wildcard expansion of builtin names [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r9pm-gxmw-wv6p.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md).
- Blocking a public module (`http`, `net`) but not its underscored internals (`_http_client`, `_http_server`, `_tls_wrap`) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r9pm-gxmw-wv6p.md).
- Blocking `inspector` but not the subpath `inspector/promises` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md).
- Omitting meta-modules like `process` that can re-import blocked builtins [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md).
- Omitting modules that expose host state or process-wide writes (`os`, `dns`) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md).
- Non-denied modules handed to the sandbox through a `readonly` proxy that forwards calls to the host [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md).

## How to review
The property that must hold: the set of modules reachable from the sandbox is defined by an explicit allowlist, and everything else is denied by default. Check:
- Is filtering allowlist-based, or does it subtract from a full enumeration?
- Does the enumeration include underscore-prefixed internals, subpath exports, and meta-modules?
- Does the denylist cover write/mutation APIs, not just readers? [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md)
- Does a `readonly` wrapper actually prevent host-side effects, or only forward calls? [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md)
- When a fix documents an invariant, enumerate every API satisfying it [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md).

## Variants seen
- Omitted observability/write modules (`os`, `dns`) admitted under `builtin: ['*']` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md).
- Underscored internal siblings of blocked network modules remain reachable [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r9pm-gxmw-wv6p.md).
- Omitted `process` and `inspector/promises` subpath allow host code execution [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md).

## Impact and severity
Sandbox escape: host identity/topology reads, host DNS hijack [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md), outbound network access [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-r9pm-gxmw-wv6p.md), and code execution in the host process [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md). Severity is high because the sandbox is the only boundary; it worsens when non-denied modules are exposed via a proxy that forwards to the host, turning a read into a write.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-m5w8-4gq2-6f8x.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-r9pm-gxmw-wv6p.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-rp36-8xq3-r6c4.md