EUVD-2026-63424

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-64846 Nix: Arbitrary file truncation outside the sandbox with recursive-nix experimental feature

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

CVE-2026-64846

Nix is a package manager for Linux and other Unix systems. Prior to 2.35.0, a malicious derivation executed with the recursive-nix experimental feature can exploit a time-of-check/time-of-use race involving final symlink handling in the LocalStore restore path. The race can cause writeFile to...

tmp: path Traversal via unsanitized prefix/postfix enables directory escape

A flaw was found in tmp, a temporary file and directory creator for Node.js. This path traversal vulnerability allows an attacker to escape the intended temporary directory. By providing specially crafted input to the prefix, postfix or dir options, an attacker can create files outside the...

GHSA-864F-RCV7-6RH4

creationtimestamp| type| source ---|---|--- 2026-08-20 16:00:51+00:00| seen| https://thehackernews.com/2026/08/isolated-vm-flaw-lets-sandboxed.html 2026-08-20 16:34:42+00:00| seen| https://bsky.app/profile/endorlabs.bsky.social/post/3mtjogb2gjk23 2026-08-21 01:00:35+00:00| seen|...

CVE-2026-61897 accountsservice: incomplete privilege drop when running Ubuntu-specific language helper scripts

An Ubuntu-specific patch to AccountsService before 23.13.9-8ubuntu7 only partially drops privileges before launching language helper scripts. It changes the effective UID/GID to the target user but leaves the real UID as 0 root. A shell spawned by a helper script inherits ruid=0 and may reset its...

Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE

Cybersecurity researchers have disclosed a critical security flaw in isolated-vm , a popular open-source sandbox with more than 2,900 stars and 190 forks on GitHub, that could allow attackers to escape the confines of the isolated environment. The vulnerability "GHSA-864f-rcv7-6rh4", which has ye...

Zapscape-Fix — Updated!

Zapscape-Fix — CVE-2026-64561 Kernel Live Patch KVM/x86 English |简体中文 A kernel live patch that fixes CVE-2026-64561 Zapscape on CentOS Stream 8 / RHEL 8 KVM hosts all 4.18.0- kernels. Without the patch : a tenant VM guest can escape to the host with guest-side actions alone and execute code with...

CVE-2026-77077

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

CVE-2026-77083

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

RUSTSEC-2026-0269 Filesystem sandbox escape when paths or symlinks contain trailing slashes

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory...

Filesystem sandbox escape when paths or symlinks contain trailing slashes

This is an entry in the RustSec database for the Wasmtime security advisory located at https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vqjp-4c8c-hfgg For more information see the GitHub-hosted security advisory...

CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77083

n8n (workflow automation platform) versions prior to 1.123.69 , 2.33.4 , and 2.34.1 are affected by a sandbox escape in the JavaScript Code node. The VM sandbox did not freeze Function.prototype, allowing an authenticated user with workflow creation and execution privileges to perform prototype p...

CVE-2026-77083 n8n before 1.123.69 Code Node Sandbox Escape via Function.prototype Pollution

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

EUVD-2026-63271

n8n is a workflow automation platform. In versions prior to 1.123.69, 2.33.4, and 2.34.1, the JavaScript Code node's VM sandbox did not freeze the sandbox's Function.prototype, allowing an authenticated user with the ability to create and execute workflows to pollute it from within a Code node...

CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...

CVE-2026-77077

n8n versions before 1.123.69, 2.33.4, and 2.34.1 have a VM sandbox escape in the task runner: the prototype-freezing routine misses internal constructors like EventEmitter, allowing an authenticated user with Code node access to pollute prototypes and execute arbitrary commands. The corruption is...

CVE-2026-77077 n8n before 1.123.69 Remote Code Execution via EventEmitter Prototype Pollution

n8n versions before 1.123.69, 2.33.4, and 2.34.1 contain a JavaScript task runner VM sandbox escape. The runner's prototype-freezing routine covers globalThis functions but not internal module constructors such as EventEmitter, allowing an authenticated user with Code node access to exploit...