CLEANSTART-2026-IT25891 vm2 is a sandbox library for running untrusted JavaScript in Node

Security vulnerability affects the n8n package. vm2 is a sandbox library for running untrusted JavaScript in Node...

PT-2026-117780

Security vulnerability affects the n8n package. vm2 is a sandbox library for running untrusted JavaScript in Node...

vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

Summary https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched. Details It is still possible to get access to VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL. PoC js const VM = require"vm2"; const vm = new VM; console.logvm.run...

EUVD-2023-1899

Malicious code in bioql PyPI...

Researchers Discover Critical Remote Code Execution Flaw in vm2 Sandbox Library

The maintainers of the vm2 JavaScript sandbox module have shipped a patch to address a critical flaw that could be abused to break out of security boundaries and execute arbitrary shellcode. The flaw, which affects all versions, including and prior to 3.9.14, was reported by researchers from Sout...

MAL-2023-759 Malicious code in sandbox-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6d2885361535f1b8ce3560f838ee3626254d32aa39d6bb41527f68ec8bd72ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sandbox-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6d2885361535f1b8ce3560f838ee3626254d32aa39d6bb41527f68ec8bd72ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in sandbox-library

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview sandbox-library is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...