CVE-2026-100721

CVE-2026-100721 — vm2 NodeVM 外部許可リストバイパス CVE-2026-100721 の Python 3 PoC — vm2 npm 3.12.2 未満 における NodeVM 外部モジュールリゾルバ の不適切な認可。信頼できない JavaScript が設定不備のエンベッダ内で実行されると、サンドボックスエスケープ およびホスト側でのコード実行 につながります。 PoC ページ: https://pocbit.org/pocs/cve-2026-100721 vm2 とは? vm2 は、同一 Node プロセス内のサンドボックス で信頼できない...

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Summary isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. nodemodules/foo2 starts with nodemodules/foo, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relati...

NPM: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

NPM: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

GHSA-7Q3F-WX44-378M vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Summary isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. nodemodules/foo2 starts with nodemodules/foo, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relati...

Exploit for CVE-2026-100721

CVE-2026-100721 — vm2 NodeVM external allowlist bypass Python...

Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configure...

GHSA-C9WR-QM7P-P6VC Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configure...

CVE-2026-100721

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

CVE-2026-100721: Incorrect Authorization

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

Remote Code Execution (RCE)

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Remote Code Execution RCE in its external module loader, lib/resolver-compat.js makeResolverFromLegacyOptions, CustomResolver.isPathAllowed, and...

CVE-2011-10043

Module::Load versions before 0.22 for Perl allow arbitrary modules outside of @INC to be loaded. Module names starting with "::" could be passed to the load function to specify arbitrary module paths. Attackers able to influence module names passed to load could use that bug to execute arbitrary...

Malicious code in ts-opus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b0105b34723dd6e1449c3353d1d4df0dcf94ae460a4dfd156566bb4ba372c7 ts-opus 0.0.8 ships an unmodified copy of MikeMcl/big.js README, copyright, and repository URL all reference big.js but injects an additional top-lev...

MAL-2026-6468 Malicious code in ts-opus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73b0105b34723dd6e1449c3353d1d4df0dcf94ae460a4dfd156566bb4ba372c7 ts-opus 0.0.8 ships an unmodified copy of MikeMcl/big.js README, copyright, and repository URL all reference big.js but injects an additional top-lev...

CVE-2026-24800 A heap-based buffer over-read or buffer overflow in tildearrow/furnace

Out-of-bounds Write, Buffer Copy without Checking Size of Input 'Classic Buffer Overflow' vulnerability in tildearrow furnace extern/zlib modules. This vulnerability is associated with program files inflate.C...

nodejs: mainModule.proto bypass experimental policy mechanism

A vulnerability has been discovered in Node.js, where the use of proto in process.mainModule.proto.require can bypass the policy mechanism and require modules outside of the policy.json definition...

Unauthorized functions in Ladle.sol and PoolRouter.sol

Handle gpersoon Vulnerability details Impact Both Ladle.sol and PoolRouter.sol contain a function batch, which gives access to several internal functions. Some of those functions call functions in other contracts which have an "auth" access control mechanism. However several internal functions ca...

Redis is not authorized to access high-risk vulnerability alerts-a vulnerability alert-the black bar safety net

Recently, Sangfor security team found that open-source databases Redis broke up an unauthorized access vulnerability, the first time for tracking and analysis of early warning. The study found that the use of the vulnerability, the attacker can achieve rally shell for arbitrary code execution...

Fedora 18 : kernel-3.6.7-5.fc18 (2012-18740)

Fixes CVE-2012-4461 and adds support for two rebranded BCM20702A0 bluetooth adapters. Also adds 1/2 of the fix for bug 859485. Latest upstream stable release v3.6.7. As usual, fixes across the tree. In addition to the listed bugs, this also fixes : - correct module signatures on PAE and...