capacitor-flaw-cve-2026-103922

Capacitor Mobile Framework Flaw CVE-2026-103922 A high-severity security flaw, tracked as CVE-2026-103922, has been identified in Capacitor, the popular cross-platform mobile application framework by Ionic. This vulnerability exposes the native bridge mechanism, potentially allowing malicious web...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the node:sqlite module exposure within the sandbox environment when certain builtins are permitted. An attacker can...

Process Control

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Process Control in the crypto.setEngine function. An attacker can execute arbitrary native code in the host process by supplying a path to a maliciou...

Process Control

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Process Control in the crypto.setEngine function. An attacker can execute arbitrary native code in the host process by supplying a pa...

CVE-2026-92938

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92939: Process Control

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call...

PT-2026-105529

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6w8r-xxw2-g3hx. This link is maintained to preserve external references. Original Description vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that built...

PT-2026-105489

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-46pr-c5wc-xffx. This link is maintained to preserve external references. Original Description vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is...

Malicious code in dolyame-ui-link (npm)

Source: amazon-inspector 26aae43ae2f260593e90c501c2863a515d4aa4f6753fccf82df101c62d43b77a index.js requires./loader on load. loader.js reconstructs attacker-controlled hostnames from split string fragments joined via.join"" to yield Cloudflare Workers hosts oob-worker.cf99-9b3.workers.dev,...

Malicious code in devplatform-sdk (npm)

Source: amazon-inspector c72866f0f03d8960696f4e272cbff49b861cc66557c5250a7d77f90a2310f33c On require'devplatform-sdk', index.js loads polyfill.js which auto-invokes start: it selects a per-OS payload path, fetches a binary from string-concatenated Cloudflare Workers hosts...

PT-2026-94311

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.3 through 3.11.6 Description When the crypto builtin is allowed, the host Node.js crypto module is exposed to a NodeVM sandbox. Although the module is presented via a recursive read-only proxy, its callable exports still...

PT-2026-94310

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.3 through 3.11.6 Description When the builtin: '' configuration or explicit permission is granted, the host node:sqlite module is exposed to code running in NodeVM. Although the module is wrapped with vm.readonly to prevent...

Malicious code in @tailwind-core/oxide-win32-x64-msvc (npm)

Source: amazon-inspector d93cb69a6f12f5739ab03d78641f2a79179750b6182f65ba5b8fb8ec4a1399bc The package name @tailwind-core/oxide-win32-x64-msvc impersonates the legitimate Tailwind CSS scope @tailwindcss published by tailwindlabs. The README claims this is the win32-x64-msvc binary for Tailwind v4...

Malicious code in weavedb-sdk-base (npm)

Source: amazon-inspector 40b4b0c5f79c0370a77c3b559b70389ffee591aa22c76ca15c4077fe95b5078e package.json declares "preinstall": "./bin/install-deps", pointing at a 976KB packed Linux x86-64 ELF binary shipped in the tarball sha256 36abd242ddaa27f0160c539377a0e92cf781c1695137850acc87e3892b436d36. Th...

Malicious code in veteran (npm)

Source: amazon-inspector 70a20dd9f8d6a9df01d766c25693711d90e4303e3c68fa371f0b842f83c485b4 On npm install, the package's postinstall hook install.js, registered via package.json line 10 "postinstall": "node install.js" downloads a platform-specific executable from...

Malicious code in envfile-sync (npm)

Source: amazon-inspector 533d78538183c16b774f6e5783cc1059558ca712fd129da9666361088485e055 Package name is 'envfile-sync' but every user-facing artifact README title, bin name, homepage, repository, bugs URL, badges, keywords, CHANGELOG brands the package as 'envsync', a lookalike of an unrelated...

Malicious code in 1cat-tunnel-client-zx (npm)

Source: amazon-inspector 796f1b18c13a38088b4e48d75575eb92b23af5d91cdfaf6a82717f0fabbc7a79 On npm install, the package's postinstall hook node install.js fetches a platform-specific executable from http://156.226.174.161:8888/binaries/tunnel-client- over plaintext HTTP, writes it to the package's...

Malicious code in dotenv-sync (PyPI)

Source: amazon-inspector c91932ecf0decc2b900d3e3cd6effe3c4cb1c4ec5ddfd98cde2460facf9f7ae1 On Windows, src/envsync/init.py lines 39-44 unconditionally calls ctypes.CDLL on a bundled 2.9MB PE file parser.pyd at top-level import, wrapped in try:... except: pass. Loading a PE via ctypes.CDLL invokes...

EUVD-2026-43116

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...

CVE-2026-14480: External Control of File Name or Path

OpenPLC Runtime v3 contains an authenticated arbitrary file write vulnerability in the legacy web UI program‑upload workflow. The application stores an attacker‑supplied filename progfile directly into the Programs.File database field and later uses this value as the destination path for an...