CVE-2026-93605 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

CVE-2026-93605 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

CVE-2026-93605

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability rated CVSS 10.0 (Critical) . The DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. When NodeVM is configured with builtin:['*'] or an explicit child_process allowance, an attacker ...

CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93604

vm2 through 3.12.0 allows untrusted guest code to cross the NodeVM isolation boundary when the embedder allowlists the crypto builtin. The builtin sanitizer in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips callable, and the readonly wrapper does not localize side effects of f...

EUVD-2026-82899

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

EUVD-2026-82898

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93603

vm2 (Node.js sandbox library) through 3.12.0 is vulnerable to a complete sandbox escape due to incorrect handling of a nullish this receiver in the apply trap of its bridge (lib/bridge.js). When sandboxed code invokes a host-provided non-strict (sloppy-mode) function without a receiver (e.g., fn(...

CVE-2026-93603 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-81627

A flaw in QEMU 's VAPIC setup hypercall (hw/i386/vapic.c) fails to validate that the writable RAM alias stays within the option ROM window. A privileged guest on a Q35/KVM machine can position this alias over locked SMRAM , bypassing chipset D_LCK protection and injecting code into System Managem...

SUSE SLES12: MozillaFirefox / MozillaFirefox-devel / etc (SUSE-SU-2026:4247-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:4247-1 advisory. Update to Firefox Extended Support Release 153.3.0 ESRi MFSA 2026-93, bsc1280371 - CVE-2026-92005: Use-after-free in the Audio/Vide...

CVE-2026-93605: Protection Mechanism Failure

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

Linux Distros Unpatched Vulnerability : CVE-2026-90231

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - apparmor: fix unconfined user namespace restriction forced stack If a task is already confined by a stack the unprivileged transition restriction on unconfined ...

CVE-2026-93603: Improper Control of Generation of Code

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

EulerOS Virtualization 2.11.1 : python-jinja2 (EulerOS-SA-2026-3460)

According to the versions of the python-jinja2 package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : Jinja is an extensible templating engine. Prior to 3.1.5, An oversight in how the Jinja sandboxed environment detects calls t...

openSUSE 16: MozillaFirefox / MozillaFirefox-branding-upstream / etc (openSUSE-SU-2026:21853-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21853-1 advisory. Firefox Extended Support Release 153.2.0 ESR MFSA 2026-85 bsc1278001: CVE-2026-75874 bmo2039972 Sandbox escape in the Remote Settings Client...