vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qhwx-74w5-xhxq. This link is maintained to preserve external references. Original Description vm2 versions = 3.9.6 and therefore executes arbitrary JavaScript in an unrestricted host Node process outside the...

PT-2026-94319

Name of the Vulnerable Software and Affected Versions vm2 versions 3.9.6 through 3.11.6 Description A NodeVM builtin allowlist bypass allows a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin. On Node.js 24+, module.builtinModules exposes the...

Malicious code in setup-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3cd9285f7d743a645d9b4834df4d7f61b6cc9bd314cf339252e7458d0f61244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in setup-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-12039 Malicious code in setup-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3cd9285f7d743a645d9b4834df4d7f61b6cc9bd314cf339252e7458d0f61244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...