NodeVM builtin denylist bypass via process and inspector/promises allows host code execution (CVE-2026-47140) | HOL Guard CVE