1281 matches found
CVE-2026-92957
A flaw was found in vm2. Untrusted code running within the sandbox can bypass module restriction policies to achieve arbitrary code execution on the underlying host. Due to improper normalization of module names containing the node: prefix, deny-list rules fail to prevent access to sensitive...
CVE-2026-92956
A flaw was found in vm2. When running untrusted code within a sandbox, improper isolation in WebAssembly streaming functions allows host error objects to leak into the sandbox environment. An attacker capable of running code inside the sandbox can exploit this flaw to escape sandbox containment a...
CVE-2026-92954
A flaw was found in vm2. An attacker capable of running untrusted code within the sandbox can trigger a Denial of Service DoS by causing the host application process to terminate. This vulnerability exists because asynchronous operations Promises returned from the host environment are not properl...
CVE-2026-92953
A flaw was found in vm2. The sandbox fails to properly isolate host object structures from untrusted code running inside the virtual machine. An attacker can exploit this issue by manipulating object prototype chains to modify shared host prototypes, resulting in prototype pollution the...
CVE-2026-92951
A flaw was found in vm2. The external package allowlist improperly validates package names using substring matching rather than exact name boundaries. An attacker capable of running code within the sandbox can exploit this issue by requesting a package name containing an allowlisted substring,...
CVE-2026-92950
A flaw was found in vm2. An attacker can achieve arbitrary code execution on the host system by escaping sandbox isolation through the command-line interface CLI tool. By supplying a malicious script that uses the require function to re-execute itself within the host environment, untrusted code c...
CVE-2026-92947
A flaw was found in vm2. The sandbox environment inadvertently exposes the host system's shared memory buffer pool to sandboxed code. An attacker running untrusted code inside the sandbox can access and modify these shared buffers, resulting in unauthorized information disclosure of host memory o...
CVE-2026-92946
A flaw was found in vm2. This vulnerability allows an attacker executing untrusted code within the sandbox to escape isolation and achieve arbitrary code execution on the host system. When external module loading is permitted without restricting access to dependency directories, sandboxed code ca...
CVE-2026-92944
A flaw was found in vm2. An attacker capable of running code within the sandbox environment can bypass security wrappers by supplying a crafted asynchronous Promise object. This flaw allows the attacker to escape the sandbox and access host system objects, leading to arbitrary code execution on t...
CVE-2026-92941
A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...
CVE-2026-92940
A flaw was found in vm2. When a sandbox is configured to permit HTTPS requests, it improperly exposes the host process's network connection manager to sandboxed code. An attacker running untrusted code within the sandbox can exploit this flaw to intercept pooled network connections released by th...
CVE-2026-92939
A flaw was found in vm2. When the cryptographic built-in module is enabled, functions exposed to the sandbox continue to run with the privileges of the host process. An attacker capable of running untrusted code within the sandbox can invoke the crypto.setEngine function to load a malicious local...
CVE-2026-92938
A flaw was found in vm2. Untrusted code running within the sandbox environment can bypass isolation restrictions when the host SQLite module is accessible. By crafting module import requests and loading native database extensions, an attacker can escape the sandbox and achieve arbitrary code...
CVE-2026-92937
A flaw was found in vm2. This vulnerability allows an attacker to escape the sandbox environment and achieve arbitrary code execution on the host system. The issue occurs because the sandbox bridge fails to properly sanitize rejected Promise errors when handlers are registered through indirect...
CVE-2026-92934
A flaw was found in vm2. A remote attacker able to run code within the sandbox can bypass environment isolation by exploiting an error handling flaw that fails to properly sanitize host objects. By accessing these unprotected host objects, an attacker can achieve arbitrary code execution and acce...
CVE-2026-92935
A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted JavaScript inside the sandbox to achieve arbitrary code execution on the host system. By providing an array value to the require configuration when nested sandboxes are enabled, the attacker can bypass...
CVE-2026-92948
A flaw was found in vm2. This vulnerability allows an attacker with permission to run code inside the sandbox to escape containment and achieve arbitrary code execution on the host system. Due to improper validation of built-in module names, the sandbox fails to block access to sensitive host...
CVE-2026-47698
A flaw was found in vm2. This vulnerability allows arbitrary code execution on the host system through a sandbox breakout. An attacker capable of running code inside the sandbox can manipulate host object properties using indirect function calls to bypass isolation boundaries and execute arbitrar...
CVE-2026-47686
A flaw was found in vm2. The sandbox fails to properly sanitize the error cause property when handling exceptions thrown by host functions. An attacker capable of running untrusted code within the sandbox can exploit this issue to access privileged host objects and bypass isolation boundaries...
