CVE-2026-106451

The yawkat LZ4 Java library (versions 1.7.0 through 1.11.4 ) is vulnerable to a TOCTOU race condition during native library extraction. The net.jpountz.util.Native.load() function creates a temporary .lck file but uses a predictable path for the actual native library. Because FileOutputStream ope...

CVE-2026-106451 yawkat LZ4 Java: Native library extraction to a shared temporary directory is vulnerable to file replacement by another local user

yawkat LZ4 Java provides LZ4 compression for Java. From 1.7.0 until 1.11.4, net.jpountz.util.Native.load uses File.createTempFile to create an exclusive temporary .lck file but derives the native-library path by removing the suffix, then FileOutputStream opens that predictable path without...

NPM: vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

NPM: vm2 allows a sandboxed plugin to execute native code through node:sqlite vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

GHSA-6W8R-XXW2-G3HX vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

Summary vm2 3.11.6 exposes Node.js's host node:sqlite module to NodeVM code when that builtin is allowed explicitly or through builtin: ''. The module is wrapped as read-only, but callable methods retain host-process authority. A sandboxed plugin can construct an in-memory database with extension...

vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

Summary vm2 3.11.6 exposes Node.js's host node:sqlite module to NodeVM code when that builtin is allowed explicitly or through builtin: ''. The module is wrapped as read-only, but callable methods retain host-process authority. A sandboxed plugin can construct an in-memory database with extension...

GHSA-46PR-C5WC-XFFX vm2 crypto builtin loads attacker native code through setEngine

Summary vm2 3.11.6 exposes the host crypto module to a NodeVM when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. crypto.setEngine accepts a filesystem path and asks OpenSSL to dynamically load the...

vm2 crypto builtin loads attacker native code through setEngine

Summary vm2 3.11.6 exposes the host crypto module to a NodeVM when that single builtin is allowed. The module is presented through a read-only bridge, but its functions still execute with host-process authority. crypto.setEngine accepts a filesystem path and asks OpenSSL to dynamically load the...

NPM: vm2 crypto builtin loads attacker native code through setEngine

NPM: vm2 crypto builtin loads attacker native code through setEngine vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...

OESA-2026-4079 lz4-java security update

LZ4 compression for Java, based on Yann Collet's work. This library provides access to two compression methods that both generate a valid LZ4 stream: fast scan LZ4: ° low memory footprint 16 KB, ° very fast fast scan with skipping heuristics in case the input looks incompressible, ° reasonable...

PT-2026-97130

Name of the Vulnerable Software and Affected Versions Nuclei versions 3.0.0 through 3.9.9 Description An out-of-bounds heap write in the Goja JavaScript runtime embedded in the javascript: protocol under pkg/js/ allows arbitrary native code execution on the host running the scanner. This occurs...

CVE-2026-93451 snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned lengt...

CVE-2026-93451 snappy-java through 1.1.10.8 Buffer Overflow via typed uncompress methods

snappy-java through 1.1.10.8 contains a buffer overflow vulnerability in typed Snappy.uncompressArray methods that allocate output arrays by dividing uncompressed length by element size but pass the undivided length to native code. Attackers controlling compressed input can cause misaligned lengt...

Protection Mechanism Failure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the node:sqlite module exposure within the sandbox environment when certain builtins are permitted. A...

Protection Mechanism Failure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Protection Mechanism Failure in the node:sqlite module exposure within the sandbox environment when certain builtins are permitted. An attacker can...

Process Control

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Process Control in the crypto.setEngine function. An attacker can execute arbitrary native code in the host process by supplying a pa...

Process Control

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Process Control in the crypto.setEngine function. An attacker can execute arbitrary native code in the host process by supplying a path to a maliciou...

GHSA-6JGM-4W45-VH8J Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-46pr-c5wc-xffx. This link is maintained to preserve external references. Original Description vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is...

GHSA-M7CQ-7F2Q-F9FH Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6w8r-xxw2-g3hx. This link is maintained to preserve external references. Original Description vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that built...

Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-6w8r-xxw2-g3hx. This link is maintained to preserve external references. Original Description vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that built...

Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-46pr-c5wc-xffx. This link is maintained to preserve external references. Original Description vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is...