CVE-2021-41773

CVE-2021-41773 CVE-2021-41773 の Docker を使用した PoC 設定 httpd.conf ファイルをカスタマイズするには、 セクションの 251 行目を Require all denied から Require all granted に変更します。 AllowOverride none Require all granted プロジェクトに Dockerfile を作成する FROM httpd:2.4.49 COPY ./httpd.conf /usr/local/apache2/conf/httpd.conf 次に、以下のコマンドを実行して...

CVE-2018-17246

CVE-2018-17246 - Kibana LFI 入力検証が行われていないため、JavaScript ファイルの名前を任意のものに変更できます。この場合、パストラバーサル手法を使用して、Kibana サーバー上の任意のファイルを選択できます。 ただし、注意すべき点として、Node の モジュールキャッシング 機能があります。基本的に、LFI はサニタイズされていないユーザー入力を Node の require...

php_filter_chain_generator

PHP filter chain generator PHPのrequireまたはincludeに渡すパラメータを完全に制御できる場合、ファイルをアップロードせずにRCEを取得できる、PHPフィルターチェーンを生成するCLIです。 使い方 ヘルプ $ python3 phpfilterchaingenerator.py --help usage: phpfilterchaingenerator.py -h --chain CHAIN --rawbase64 RAWBASE64 PHP filter chain generator. optional arguments: -h, --he...

CVE-2026-22686-RemoteCodeExecution-RCE-PoC

ESM 环境中的 RCE — require 问题 通过 CVE-2026-22686 实现沙箱逃逸后，在 ESM 项目（"type": "module"）中执行操作系统命令需要绕过 Node.js 模块加载限制。标准方法因以下原因而失败： 向量| 结果 ---|--- require'childprocess'| ❌ require is not defined — 在 ESM 中不可用 process.mainModule.require...| ❌ Cannot read properties of undefined — mainModule 在 ESM 中为 undefined...

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...

NPM: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

host-realm require is reachable from sandboxed scripts vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

EUVD-2026-81599

vm2 CLI provides no sandbox isolation - host-realm require is reachable from sandboxed scripts...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

EUVD-2026-81585

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE...

GHSA-8HR7-R645-PC6W vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

NPM: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

NPM: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.4, = 3.11.6...

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Summary isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. nodemodules/foo2 starts with nodemodules/foo, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relati...

CVE-2021-41773-i-

CVE-2021-41773 CVE-2021-41773 Dockerを使用したPOC 設定 httpd.confファイルをカスタマイズするには、セクションの251行目をRequire all deniedからRequire all grantedに変更します。 AllowOverride none Require all granted プロジェクトにDockerfileを作成する FROM httpd:2.4.49 COPY ./httpd.conf /usr/local/apache2/conf/httpd.conf...

ZITADEL: Actions V1 sandbox escape: host file read via require()

Summary A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript require module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials including the Login Client PAT and...

GHSA-FGMF-7RF8-M6VF ZITADEL: Actions V1 sandbox escape: host file read via require()

Summary A vulnerability in ZITADEL Actions V1 allows an organization Action author to read files from the ZITADEL host filesystem through the JavaScript require module loader. On common self-hosted deployments this can be chained to steal bootstrap credentials including the Login Client PAT and...

CVE-2026-85057

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

CVE-2026-85057 ZITADEL: Actions V1 sandbox escape: host file read via require()

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...

CVE-2026-85057 ZITADEL: Actions V1 sandbox escape: host file read via require()

ZITADEL is an open source identity management platform. From 3.0.0 until 3.4.13 and 4.16.1, ZITADEL Actions V1 enables the goja Node-compatible require registry without restricting its filesystem source loader. An organization Action author with ORGOWNER, org.action.write, and org.flow.write...