vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

GHSA-8686-VHFX-7R3J vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

GHSA-647F-G98J-QQ25 vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js process when an embedder-exposed host Promise rejects. This is an incomplete fix for GHSA-m283-3h24-438v: the advisory's capability-bearing rejection rebuild runs only through this...

automatic-spike-detection (>=1.0.0b0, <=1.2.4), snraspi-lib (1.0.6) +1 more potentially affected by CVE-2026-102925 via virtualenv (20.24.4)

virtualenv PYPI version 20.24.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - automatic-spike-detection =1.0.0b0, =5.0.0, =5.0.1 Source cves: CVE-2026-102925 Source advisory: OSV:GHSA-P58F-9548-MPM2...

automatic-spike-detection (>=1.0.0b0, <=1.2.4), snraspi-lib (1.0.6) +1 more potentially affected by CVE-2026-102937 via virtualenv (20.24.4)

virtualenv PYPI version 20.24.4 is affected by a known vulnerability. The following packages have a transitive dependency on virtualenv and may be impacted: - automatic-spike-detection =1.0.0b0, =5.0.0, =5.0.1 Source cves: CVE-2026-102937 Source advisory: OSV:GHSA-X78J-V8H9-3J2Q...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-102999 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-102999 Source advisory: OSV:GHSA-V247-6F48-MGCJ...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-102998 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-102998 Source advisory: OSV:GHSA-PHP9-FJ8V-98FJ...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-103000 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-103000 Source advisory: OSV:GHSA-W23X-9JRW-R45C...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-102997 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-102997 Source advisory: OSV:GHSA-JW7Q-GVRG-4VJ3...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-102996 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-102996 Source advisory: OSV:GHSA-G9CG-PRRW-2R8Q...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-102995 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-102995 Source advisory: OSV:GHSA-FP3H-C4FM-7VVF...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-102994 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-102994 Source advisory: OSV:GHSA-5JQ2-8X83-X246...

gai-common (>=0.1.2, <=0.86.0), gai-lib (0.120.0) +4 more potentially affected by CVE-2026-102993 via pypdf (4.3.0)

pypdf PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on pypdf and may be impacted: - gai-common =0.1.2, =1.1.3, =0.3.1, =5.3.8, =0.6.6, =0.7.0 Source cves: CVE-2026-102993 Source advisory: OSV:GHSA-QV6H-RV94-W285...

ROOT-OS-ALPINE-324-CVE-2026-56109 CVE-2026-56109 in alsa-lib - Patched by Root

Root has patched CVE-2026-56109 in the alsa-lib package for Root:Alpine:3.24. Multiple fixed versions available...

CLEANSTART-2024-VX77330 idn2_to_ascii_4i in lib/lookup

Security vulnerability affects the libidn2 package. idn2toascii4i in lib/lookup...

lib/helpers/Http2Sessions.js axios Bypass

The vulnerability of the lib/helpers/Http2Sessions.js file from the axios library is related to insufficient validation of requests on the server side. Exploiting this vulnerability could allow a malicious actor to bypass existing security mechanisms...

Rocky Linux 8 [CIQ] Security Update: graphviz / graphviz-debuginfo / graphviz-debugsource / etc (crlsa-2021_4256)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-20214256 advisory. graphviz: off-by-one in parsereclbl in lib/common/shapes.c CVE-2020-18032 Tenable has extracted the preceding description block directly from the CIQ security...

CentOS Linux 7 [TuxCare] Security Update: emacs / emacs-common / emacs-el / emacs-filesystem / emacs-nox / etc (CENTOS7:CLSA-2024:1728055873)

The CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the TuxCare CENTOS7:CLSA-2024:1728055873 advisory. - GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c...