vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...

NPM: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

host-realm require is reachable from sandboxed scripts vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

EUVD-2026-81600

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package...

GHSA-C48M-32M9-VX93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

vm2 crypto builtin loads attacker native code through setEngine

Summary vm2 3.11.6 exposes the host crypto module to a NodeVM when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. crypto.setEngine accepts a filesystem path and asks OpenSSL to dynamically load the...

NPM: vm2 NodeVM can replace the host process TLS trust store

NPM: vm2 NodeVM can replace the host process TLS trust store vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

CVE-2024-21626-PoC

CVE-2024-21626 Root cause & Proof of Concept How to use poc-autoplay? make install make uninstall 1. Root cause In runc versions ≤ 1.1.11, when opening the host's /sys/fs/cgroup directory to set cgroups, the file descriptor is left open for the container initialization process without closing it,...

fast-uri: fast-uri: Host confusion via skipped IDN canonicalization

A flaw was found in fast-uri, a URI parser for Node.js. This vulnerability arises because the parser fails to consistently convert internationalized domain names IDN to their standard ASCII form when processing scheme-relative references. This inconsistency can lead to host confusion, where an...

foreman: Excessive Permissions for Viewer Role on Preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

CVE-2025-32462_32463-Lab

CVE-2025-32462 & CVE-2025-32463 – PoC Lab This is a container-based lab and PoC for the following vulnerabilities in sudo: CVE-2025-32462 – sudo -h host matching logic bypass CVE-2025-32463 – sudo -R chroot NSS library escape 🔒 For educational purposes only. Do not use on systems you don’t own or...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-10841 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling. CWE:CWE-444: Inconsistent...

CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

EUVD-2026-90871

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...