CVE-2026-11114-Node.js-vm-Sandbox-Escape-via-Proxy

CVE-2026-11114 – Node.js vm サンドボックスエスケープ（Proxy経由） プログラムコード Node.js // sandboxserver.js - Vulnerable VM sandbox const vm = require'vm'; const express = require'express'; const app = express; app.useexpress.json; app.post'/eval', req, res = const code = req.body.code; const sandbox = console: log: ...

CVE-2025-68613

CVE-2025-68613 n8n은 오픈소스 워크플로우 자동화 플랫폼입니다. 0.211.0부터 1.120.4, 1.121.1, 1.122.0 미만 버전에는 워크플로우 표현식 평가 시스템에 치명적인 원격 코드 실행RCE 취약점이 존재합니다. 특정 조건에서 인증된 사용자가 워크플로우 구성 중 제공한 표현식이 기본 런타임으로부터 충분히 격리되지 않은 실행 컨텍스트에서 평가될 수 있습니다. 인증된 공격자는 이러한 동작을 악용하여 n8n 프로세스의 권한으로 임의 코드를 실행할 수 있습니다. 악용에 성공하면 민감한 데이터에 대한 무단 접...

CVE-2020-15215-Discord-POC

Discord Electron ISO 境界検証 PoC 概要 このリポジトリは、Discord スタイルのデスクトップアーキテクチャにおける Electron の境界強化のための概念実証 PoC 検証ハーネスです。レンダラー/メインプロセス分離、preload ブリッジポリシー、IPC チャネル露出、ナビゲーション制御、ランタイム監視をモデル化し、設定ミスがアプリケーションの隔離保証をどのように弱め得るかを研究します。 参考事例の詳細は以下で追跡されています: https://bugbounty.com/211356433 脆弱性のコンテキスト このケーススタディは、Electron...

CVE-2026-59308

Spring AI 2.0.0 contains a vulnerability in its Semantic Cache support. The context hash mechanism, intended to isolate cached responses between different system prompts, is insufficient and could allow cached responses to be shared across unrelated contexts . This results in low confidentiality ...

GO-2026-6205 Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik

Traefik: Gateway HTTPRoute backendRef filters can leak backend context across routes sharing a Service:port in github.com/traefik/traefik...

Security Bulletin: IBM Bob Premium Package for i is affected by multiple vulnerabilities

Summary There are multiple vulnerabilities in IBM Bob Premium Package for i. fast-uri can fail to canonicalize Unicode hostnames CVE-2026-13676. Hono Web Application framework can allow untrusted className values CVE-2026-59895, does not isolate context vales CVE-2026-59896, can drop distinct...

The vulnerability of the context Isolation mechanism of the software platform for creating Electron applications allows a attacker to gain full access to the system.

The vulnerability of the context isolation mechanism of the Electron application development platform is related to the breach of data protection mechanisms. Exploiting this vulnerability allows an attacker operating remotely to gain full access to the system...

CVE-2026-70610 Electron: contextBridge object copy honors prototype setters

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

CVE-2026-70610 Electron: contextBridge object copy honors prototype setters

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

CVE-2026-70601

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

GHSA-H7RP-CF8H-J98X Electron: Context isolation bypass via Function.prototype.bind hijack

Impact Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, o...

Electron: Context isolation bypass via Function.prototype.bind hijack

Impact Apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web content could obtain access to the isolated preload world and, through it, every capability the preload script has. In renderers without a sandbox, o...

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack

NPM: Electron: Context isolation bypass via Function.prototype.bind hijack vulnerability discovered by ? in WordPress Npm electron versions 39.8.9...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601

CVE-2026-70601 affects Electron, a framework for building cross‑platform desktop apps with JavaScript/HTML/CSS. The issue arises when apps expose Promise‑returning functions to web content via contextBridge, allowing a context isolation bypass. In environments where a sandbox is absent or nodeInt...

CVE-2026-70601 Electron: Context isolation bypass via Function.prototype.bind hijack

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70601: Protection Mechanism Failure

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.5, apps that expose Promise-returning functions to web content via contextBridge may be vulnerable to a context isolation bypass. Untrusted web...

CVE-2026-70610: Improperly Controlled Modification of Object Prototype Attributes

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to 39.8.9, 40.9.2, 41.2.2, and 42.0.0-beta.4, objects copied across the contextBridge boundary from untrusted content could carry an attacker-influenced prototype, enabling...

SUSE CVE-2026-34448

SiYuan is a personal knowledge management system. Prior to version 3.6.2, an attacker who can place a malicious URL in an Attribute View mAsse field can trigger stored XSS when a victim opens the Gallery or Kanban view with “Cover From - Asset Field” enabled. The vulnerable code accepts arbitrary...