@stackflag.bsky.socialCVE-2026-100721 - vm2
The vm2 library version earlier than 3.12.2 can be tricked into loading code it should block, allowing code running inside a sandbox to execute on the host system. This happens when a…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-93606 - vm2
Versions of the vm2 package prior to 3.12.1 allow code running inside its sandbox to break out and interact directly with the host system. If the sandbox is given a host function that…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-93605 - vm2
Versions of the vm2 NodeVM library before 3.12.1 let a malicious piece of code access the system's command tool and run any command it wants. This can happen when the sandbox is set to…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-93603 - vm2
The vm2 JavaScript sandbox (versions before 3.12.1) can mistakenly give untrusted code access to the host system's global objects. If your application exposes any non‑strict host…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92957 - vm2
The vm2 sandbox library (versions before 3.11.7) does not correctly block the built‑in child_process module when a deny list uses the “node:” prefix. As a result, code running inside the…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92956 - vm2
Versions 3.10.1 through 3.11.6 of the vm2 library let code run inside its default sandbox reach the underlying Node.js environment. An attacker could obtain the real process object and…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92954 - vm2
Versions of the vm2 sandbox library between 3.10.0 and 3.11.5 can let malicious code ignore a failed promise from the host application, causing Node.js to shut down the entire process.…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92953 - vm2
Versions of the vm2 sandbox from 3.11.0 up to 3.11.7 do not stop code running inside the sandbox from changing core JavaScript objects that control binary data handling. This means an…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92951 - vm2
The vm2 sandbox library can be tricked into loading code that isn’t approved, letting attackers run unwanted programs on the host system. This happens because the library checks package…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92948 - vm2
Versions of the vm2 library from 3.9.6 up to 3.11.6 let specially crafted code break out of its sandbox when Node.js 24 or later is used and the node:test module is allowed. This means…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92946 - vm2
The vm2 sandbox library for Node.js can let attackers run commands on the server if the "require.external" option is turned on without proper restrictions. This could let malicious code…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92944 - vm2
The vm2 library that isolates JavaScript code can be bypassed in versions 3.10.2 through 3.11.6, allowing a crafted script to break out of the sandbox and execute code on the host…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92947 - vm2
The vm2 module versions before 3.11.7 let code running inside its sandbox access Node’s shared memory buffers. This means a malicious script could read or change data that should stay…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92941 - vm2
Versions of vm2 between 3.11.3 and 3.11.6 allow code running inside the sandbox to modify the Node.js TLS settings for the whole host. This lets an attacker replace the list of trusted…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92940 - vm2
Versions 3.11.3 through 3.11.6 of the vm2 tool let code running in an isolated environment see the real HTTPS connections the host makes. This can allow that code to capture…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92938 - vm2
Versions 3.11.3 through 3.11.6 of the vm2 sandbox let code inside a plugin access the underlying Node.js SQLite library and load native code. This can let an attacker run arbitrary…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92937 - vm2
The vm2 sandbox library version 3.11.6 can be tricked into exposing the underlying Node.js process, allowing untrusted code to execute commands on the server. This occurs when a rejected…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92935 - vm2
Versions of the vm2 sandbox between 3.11.4 and 3.11.6 let a specially crafted script bypass the isolation and load the host vm2 module. This lets an attacker create a new sandbox with…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92960 - vm2
The vm2 sandbox library, versions earlier than 3.11.6, does not properly block certain system functions. As a result, code running inside the sandbox can see details about the server it…
Too many irrelevant or confusing CVEs? Use stackflag.com
@stackflag.bsky.socialCVE-2026-92955 - vm2
The vm2 package used to isolate JavaScript code can be bypassed in versions older than 3.11.8, allowing a malicious script to break out of its sandbox and run commands on the server…
Too many irrelevant or confusing CVEs? Use stackflag.com