CVE Notifier

CVE-2026-92944 CWE-693 9.8

vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Att…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92942 CWE-400 7.5

vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the single call to _runScript() via doWithTimeout…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92941 CWE-732 10.0

vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access …

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92940 CWE-668 10.0

vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92939 CWE-114 9.9

vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute wit…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92938 CWE-693 9.9

vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(),…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92937 CWE-94 10.0

vm2 3.11.6 Remote Code Execution via Promise call/apply

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the dir…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92936 CWE-209 5.8

vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for exam…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92935 CWE-913 9.0

vm2 NodeVM Remote Code Execution via Array-Shaped Require

vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92934 CWE-693 9.0

vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers ca…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92933 CWE-200 5.8

vm2 before 3.11.8 Information Disclosure via util.getCallSites

vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), an…

cve.org patriksimek:vm2 6 hari lalu

CVE-2026-92973 CWE-79 6.1

ansi2html 1.7.0a0 through 1.9.3 Cross-Site Scripting via OSC 8

ansi2html versions 1.7.0a0 through 1.9.3 contain a cross-site scripting vulnerability in OSC 8 hyperlink handling that fails to validate or escape URL targets. Attackers controlling ANSI text input can inject javascript:…

cve.org pycontribs:ansi2html 6 hari lalu