CVE-2026-93605: Javascript Sandbox Builtin Denylist Missing Child Processcve-2026-93605-javascript-sandbox-builtin-denylist-missing-child-process
This sandbox builtin denylist blocks Node.js host-escape builtins (module/worker_threads/cluster/vm/repl/inspector/process/...) but omits 'child_process'. A denylist shaped like this typically drives both the '*' wildcard expansion and the explicit builtin allowlist of a sandbox require() loader, so the real host child_process module is admitted and handed t
