vm2

vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Installation npm install vm2 Quick Examples import VM from...

CVE-2022-36067-vm2-POC-webapp

CVE-2022-36067-vm2-POC-webapp Steps to reproduce 1. maybe install vm2 globally first npm -install [email protected] -g 2. run: node index.js 3. visit http://localhost:5000/poc 4. Upload poc file such as poc2.js or code and observe RCE...

CVE-2023-30547

CVE-2023-30547 PoC Exploit for VM2 Sandbox Escape Vulnerability alt img Description vm2 3.9.17 is vulnerable to arbitrary code execution due to a flaw in exception sanitization. Attackers can exploit this by triggering an unsanitized host exception within handleException, enabling them to escape...

CVE-2023-30547

CVE-2023-30547 vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException which can be used to esca...

CVE-2023-30547

CVE-2023-30547 This is a Proof-of-Concept to CVE-2023-30547 https://nvd.nist.gov/vuln/detail/CVE-2023-30547. I created this PoC during a CTF. Usage CVE-2023-30547 PoC -h --url URL --lhost LHOST --lport LPORT PoC for the vm2 vulnerability CVE-2023-30547 options: -h, --help show this help message a...

Codify-TJNULL-OSCP-

Hack The Box — Codify Writeup Full penetration testing walkthrough and writeup for Codify machine on Hack The Box. 📌 Machine Info Field| Value ---|--- Name| Codify OS| Linux Difficulty| Easy Key Concepts| vm2 RCE CVE-2023-30547, SQLite DB Enum, Bcrypt Cracking, Bash Wildcard Pattern Matching Abus...

CVE-2026-92956__vm2__test__20261012

vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Features Runs untrusted code securely in a single process wi...

Node_CVE-2023-29017

CVE-2023-29017 | Remote Code Execution via vm2 Sandbox Escape WHS 4th Generation, Class 31 - Kim Geon-woo @gunwoo105 Vulnerability Summary vm2 is a Node.js sandbox library for executing untrusted JavaScript in a restricted environment. Under normal circumstances, code inside the sandbox should no...

n8n-function-vm2

abraxaslabs.tech · github.com/abraxas · @abraxasnull · [email protected] · n8n-function-vm2 Write-up: https://abraxaslabs.tech/research/n8n-function-vm2 n8n-function-vm2 n8n 2.42.0 - n8n GmbH GHSA-j4p8-h8mh-rh8q moved n8n-nodes-base.code onto the JS task-runner child. Production spawn adds...

CVE-2023-30547

CVE-2023-30547 Vulnerability description vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException...

ROOT-APP-NPM-CVE-2026-100721 CVE-2026-100721 in vm2 - Patched by Root

Root has patched CVE-2026-100721 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-100722 CVE-2026-100722 in vm2 - Patched by Root

Root has patched CVE-2026-100722 in the vm2 package for Root:npm. Multiple fixed versions available...

ROOT-APP-NPM-CVE-2026-93605 CVE-2026-93605 in vm2 - Patched by Root

Root has patched CVE-2026-93605 in the vm2 package for Root:npm. Multiple fixed versions available...

vm2-nesting-check

vm2-nesting-check Offline evidence checker for CVE-2026-92935: vm2 array-shaped require nesting escape alias GHSA-8hr7-r645-pc6w. It compares explicitly supplied vm2 package versions with the reviewed advisory ranges and reports what that version evidence does and does not show. Python 3.10+,...

CVE-2026-119978 Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOWBUILTINDEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth...

CVE-2026-119978

Versions of Flowise through 3.1.4 are vulnerable to a sandbox escape vulnerability leading to Remote Code Execution (RCE) . When ALLOW_BUILTIN_DEP=true is enabled, an authenticated user can submit malicious JavaScript to the /api/v1/node-custom-function endpoint. This allows the attacker to abuse...

CVE-2026-119978 Flowise through 3.1.4 Custom Function Sandbox Escape RCE via LocalFileStore

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOWBUILTINDEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth...

EUVD-2026-114243

Flowise through 3.1.4 contains a sandbox escape vulnerability that allows authenticated users to execute OS commands by abusing allowlisted langchain and mammoth modules when ALLOWBUILTINDEP=true. Attackers can submit JavaScript to /api/v1/node-custom-function that writes a file into the mammoth...

FlowiseAI Flowise permission and access control issue vulnerability

FlowiseAI Flowise versions 3.1.4 and earlier contain a vulnerability related to permission escalation and access control. This vulnerability stems from a sandbox escape issue: attackers can submit JavaScript to /api/v1/node-custom-function, then write files to the mammoth package via LocalFileSto...

PT-2026-133730

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.5 Description Authenticated users can execute operating system commands by escaping the custom function sandbox. This occurs when the ALLOW BUILTIN DEP variable is set to true, allowing the abuse of allowlisted...