NPM: vm2: Sandbox Escape (NodeVM)

NPM: vm2: Sandbox Escape NodeVM vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

GHSA-88HF-G992-JG85 vm2: Sandbox Escape (NodeVM)

Summary It being possible to obtain the host proto getter/setter, has been used in many reports: - https://github.com/patriksimek/vm2/security/advisories/GHSA-vwrp-x96c-mhwq - https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg -...

EUVD-2026-81604

vm2: Sandbox Escape NodeVM...

EUVD-2026-81602

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix...

EUVD-2026-81584

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit...

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...

GHSA-X965-FC75-JPQH vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...

EUVD-2026-81596

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool...

EUVD-2026-81605

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass...

NPM: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

NPM: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass vulnerability discovered by ? in WordPress Npm vm2 versions = 3.10.1, = 3.11.6...

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Summary There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required. The escape is a patch-bypass of the same...

GHSA-WJWH-QQVP-G4P4 vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass

Summary There is a sandbox escape in vm2 3.11.5 / current HEAD when it is used on Node.js 26. The issue is reachable from a default new VM sandbox. No NodeVM, require permission, host object injection, or intentionally unsafe configuration is required. The escape is a patch-bypass of the same...

CVE-2026-100818

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the Widget: Gtk component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

CVE-2026-103631

A buffer overflow flaw was found in the WebRTC component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/567088927...

CVE-2026-100770

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red H...

CVE-2026-100762

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Content Processes component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red H...

CVE-2026-100778

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Sandbox escape due to use-after-free in the DOM: Core & HTML component Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat...

CVE-2026-45524

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

EUVD-2026-92599

In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...