CVE-2026-47686

A flaw was found in vm2. The sandbox fails to properly sanitize the error cause property when handling exceptions thrown by host functions. An attacker capable of running untrusted code within the sandbox can exploit this issue to access privileged host objects and bypass isolation boundaries...

PT-2026-95382

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.1 Description An issue exists in the apply trap of the bridge lib/bridge.js where a nullish this receiver is not correctly handled. When sandboxed code invokes a host-provided non-strict sloppy-mode function without ...

PT-2026-45021

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.4 Description A sandbox escape exists that allows attackers to execute arbitrary code on the host system. This is achieved by combining Buffer.call.call. lookupGetter , Buffer, " proto ", Buffer.call.call. lookupSett...

CVE-2026-44008 vm2: Snabox breakout via `neutralizeArraySpeciesBatch`

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects...

Cross site request forgery (csrf)

Nagios Core application version 4.2.4 is vulnerable to Site-Wide Cross-Site Request Forgery CSRF in many functions, like adding – deleting for hosts or servers...