530 matches found
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
Affected: vm2 = 3.11.3 CVSS 3.1: 9.9 HIGH CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE: CWE-693 Protection Mechanism Failure Prerequisite: Embedder exposes a host function that throws an Error with .cause referencing a powerful host object e.g., process Summary I found that handleException in...
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Summary vm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike The bufferAllocLimit option introduced in 3.11.0 GHSA-6785-pvv7-mvg7 caps host-side Buffer allocations driven by sandbox code, the way embedders opt into timeout. The cap wraps Buffer.alloc, Buffer.allocUnsafe,...
NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
NPM: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.5...
PT-2026-76817
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description A sandbox breakout allows code running within the environment to escape and execute arbitrary commands on the host system. The issue occurs because lib/bridge.js and lib/setup-sandbox.js fail to block...
PT-2026-76815
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...
PT-2026-76816
Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.6 Description In the handleException function within lib/setup-sandbox.js, the software fails to sanitize the Error.cause property introduced in ES2022. While the function recursively sanitizes SuppressedError.error,...
CVE-2026-73602
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...
CVE-2026-73483
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
CVE-2026-73602
Flowise up to 3.1.3 contains a sandbox escape in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by bypassing moment locale validation. An attacker can craft a fake String object with a match function to bypass path traversal checks and load/execute malicious ...
CVE-2026-73602 Flowise before 3.1.3 Sandbox Escape to RCE
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...
EUVD-2026-57806
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...
CVE-2026-73602 Flowise before 3.1.3 Sandbox Escape to RCE
Flowise before 3.1.3 contains a sandbox escape vulnerability in the vm2 JavaScript sandbox that allows authenticated users to execute arbitrary code by exploiting moment locale validation bypass. Attackers can craft a fake String object with a match function that bypasses path traversal checks to...
EUVD-2026-57799
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
CVE-2026-73483 Flowise before 3.1.3 Sandbox Escape via Puppeteer
Flowise packages flowise and flowise-components in versions = 3.1.2 contain a sandbox escape in the vm2/@flowiseai/nodevm JavaScript sandbox. An authenticated user with access to the /api/v1/node-custom-function endpoint can escape the sandbox by supplying attacker-controlled executablePath and...
GHSA-WG86-R78F-74MP Flowise Sandbox Escape to RCE
============================================================================= Security Advisory elttam Topic: Flowise JavaScript Sandbox Escape Module: FlowiseAI/Flowise, FlowiseAI/nodevm Disclosed: 11-Apr-2026 Credits: Luke Jahnke and Alex Brown Affects: FlowiseAI/Flowise 3.1.1, FlowiseAI/nodevm...
ROOT-APP-NPM-AIKIDO-2026-10729 AIKIDO-2026-10729 in @rootio/vm2 - Patched by Root
Root has patched AIKIDO-2026-10729 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44004 CVE-2026-44004 in @rootio/vm2 - Patched by Root
Root has patched CVE-2026-44004 in the @rootio/vm2 package for Root:npm. Multiple fixed versions available...