1279 matches found
CVE-2026-100721
The vm2 library (versions before 3.12.2 ) contains an authorization bypass in the NodeVM external-module resolver. When an embedder uses a custom resolver with context: 'host', the LegacyResolver.customResolve function in lib/resolver-compat.js fails to include a path separator or end-of-string b...
CVE-2026-100722: Uncaught Exception
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If...
CVE-2026-100721: Incorrect Authorization
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...
PT-2026-99450
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2 Description The software fails to apply the Buffer backing-store ownership invariant to Buffers returned from host builtin modules. When the zlib module is exposed via the NodeVM builtin allowlist, the...
CVE-2026-100723: Exposure of Sensitive Information to an Unauthorized Actor
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...
CLSA-2026-1790461115 TuxCare security update for vm2 (4 CVEs)
TuxCare rebuilt vm2 to address 4 CVEs. Fixed in 3.11.5-tuxcare.2...
CVE-2026-93603
A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted script within the sandbox to achieve arbitrary code execution on the underlying host system by escaping sandbox containment. The issue occurs because vm2 fails to properly handle function calls lacking an...
CVE-2026-93606
A flaw was found in vm2. An attacker running untrusted code within the sandbox can bypass isolation controls to achieve arbitrary code execution on the host system. This issue is caused by improper sanitization of host Promise objects, which allows sandboxed scripts to manipulate Promise...
CVE-2026-93605
A flaw was found in vm2. The sandbox environment fails to restrict access to the childprocess module, which handles system command execution. In environments configured to allow built-in modules, an attacker capable of running untrusted code within the sandbox can load this module to break...
CVE-2026-93604
A flaw was found in vm2. Untrusted guest code can exploit this vulnerability when the crypto builtin is explicitly allowlisted for a NodeVM Node.js Virtual Machine. By calling the crypto.setFips function, an attacker can modify the FIPS Federal Information Processing Standards mode of the entire...
ROOT-APP-NPM-AIKIDO-2026-10729 AIKIDO-2026-10729 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10729 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10846 AIKIDO-2026-10846 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10846 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10723 AIKIDO-2026-10723 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10723 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10716 AIKIDO-2026-10716 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10716 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10689 AIKIDO-2026-10689 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10689 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10843 AIKIDO-2026-10843 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10843 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10721 AIKIDO-2026-10721 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10721 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-AIKIDO-2026-10839 AIKIDO-2026-10839 in vm2 - Patched by Root
Root has patched AIKIDO-2026-10839 in the vm2 package for Root:npm. Multiple fixed versions available...