CVE Notifier

CVE-2026-92956 CWE-693 10.0

vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92955 CWE-913 10.0

vm2 before 3.11.8 Sandbox Escape via NodeVM

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.proto…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92954 CWE-248 8.6

vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise

vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Pro…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92953 CWE-913 10.0

vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %Type…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92952 CWE-669 6.8

vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass

vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in …

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92951 CWE-706 9.9

vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass th…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92950 CWE-453 8.6

vm2 before 3.11.7 Sandbox Escape via CLI require

vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92949 CWE-471 4.0

vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.ge…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92948 CWE-693 9.9

vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test

vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { built…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92947 CWE-200 10.0

vm2 before 3.11.7 Memory Disclosure via Buffer Pool

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffe…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92946 CWE-913 10.0

vm2 before 3.11.7 Remote Code Execution via require.external

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an …

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92945 CWE-22 4.2

vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages shar…

cve.org patriksimek:vm2 6 hari lalu