CVE-2026-92945

A flaw was found in vm2. This vulnerability allows an attacker to bypass the module allowlist, a security feature designed to restrict access to certain software modules. The flaw occurs due to an incorrect string comparison method used in the isPathAllowedForModule function. By exploiting this, ...

CVE-2026-92948

vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7...

CVE-2026-92951

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92951

vm2 prior to version 3.11.7 is affected by an incorrect authorization flaw in its external package allowlist mechanism. The root cause is the use of non-exact substring matching instead of full package-name boundary validation, allowing an attacker to require a colliding package name that merely ...

CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

EUVD-2026-81600

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowliste...

CVE-2026-92948

vm2 (a Node.js sandboxing library) versions 3.9.6 through 3.11.6 are vulnerable to a sandbox escape on Node.js 24+ when the embedder explicitly allows the node:test builtin. On Node.js 24, module.builtinModules exposes the scheme-only key node:test, which bypasses vm2's DANGEROUS_BUILTINS family-...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

EUVD-2026-81594

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass in the isPathAllowedForModule function. The root cause is the use of raw string prefix matching instead of a boundary-anchored comparison, allowing attackers to reach non-allowlisted packages that share a name prefix with an allowlisted module....

log4j-4255

log4j2 4255 — FilteredObjectInputStream 허용 목록 우회 java.rmi.MarshalledObject 경유 Apache log4j2 이슈4255 를 공식 Log4j 2.26.1 아티팩트와 JDK 17 환경에서 종단 간 재현하는 독립형 컨테이너 실습 환경입니다. 양성 대조군, 강화된 오라클, 검증된 완화 조치를 포함합니다. ⚠️ 책임 있는 사용 이 실습 환경에는 현재 패치되지 않은 Log4j 이슈4255은 작성 시점 기준 OPEN / waiting-for-maintainer 상태이며, CVE가...

NocoBase - VM Sandbox Escape to Remote Code Execution

NocoBase Workflow Script Node executes user-supplied JavaScript inside a Node.js vm sandbox with a custom require allowlist controlled by WORKFLOWSCRIPTMODULES env var. The console object passed into the sandbox context exposes host-realm WritableWorkerStdio stream objects via console.stdout and...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-92801

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. While the text message handler applies per-user access controls, the card action handler does not, allowing attackers with low privileges in admitted chats to ...

CVE-2026-92801 cc-connect through 1.5.0 User Allowlist Bypass via Feishu Card Actions

cc-connect through 1.5.0 fails to enforce per-user allowlist filtering in the onCardAction handler for Feishu interactive card callbacks. Attackers can dispatch agent commands by triggering card actions in admitted chats, bypassing the per-user access controls that protect the text message handle...

CVE-2026-47215 Singularity: Incorrect path matching for 'limit container paths' directive

SingularityCE and SingularityPRO are open source container platforms. Prior to SingularityCE 4.4.2 and SingularityPRO 4.3.9 and 4.1.14, incorrect path-string matching in the singularity.conf limit container paths directive allows a container in a sibling directory such as /data/safe-but-unsafe to...

CVE-2026-91997 evolution-api through 2.3.7 Prometheus Metrics IP Allowlist Bypass

evolution-api through 2.3.7 contains an incorrect array comparison in the metricsIPWhitelist middleware that always evaluates to false, allowing unauthenticated access to the /metrics endpoint. Attackers can bypass IP whitelist restrictions to access sensitive metrics disclosing server version,...

DEBIAN-CVE-2026-86472

fast-uri is a dependency-free RFC 3986 URI parser for Node.js, used by Fastify and ajv. In versions before 2.4.7, from 3.0.0 through 3.1.7, and from 4.0.0 through 4.1.4, fast-uri folds the host to lowercase before it percent-decodes the host, so a percent-encoded uppercase octet such as %41 decod...