1160 matches found
CVE-2026-92941
A flaw was found in vm2. The sandbox improperly exposes the host Transport Layer Security TLS module to untrusted code running within the sandbox environment. An attacker can exploit this issue using allowed built-in utilities to modify the process-wide certificate authorities. This manipulation...
CVE-2026-92940
A flaw was found in vm2. When a sandbox is configured to permit HTTPS requests, it improperly exposes the host process's network connection manager to sandboxed code. An attacker running untrusted code within the sandbox can exploit this flaw to intercept pooled network connections released by th...
CVE-2026-92939
A flaw was found in vm2. When the cryptographic built-in module is enabled, functions exposed to the sandbox continue to run with the privileges of the host process. An attacker capable of running untrusted code within the sandbox can invoke the crypto.setEngine function to load a malicious local...
CVE-2026-92938
A flaw was found in vm2. Untrusted code running within the sandbox environment can bypass isolation restrictions when the host SQLite module is accessible. By crafting module import requests and loading native database extensions, an attacker can escape the sandbox and achieve arbitrary code...
CVE-2026-92937
A flaw was found in vm2. This vulnerability allows an attacker to escape the sandbox environment and achieve arbitrary code execution on the host system. The issue occurs because the sandbox bridge fails to properly sanitize rejected Promise errors when handlers are registered through indirect...
CVE-2026-92934
A flaw was found in vm2. A remote attacker able to run code within the sandbox can bypass environment isolation by exploiting an error handling flaw that fails to properly sanitize host objects. By accessing these unprotected host objects, an attacker can achieve arbitrary code execution and acce...
CVE-2026-92935
A flaw was found in vm2. This vulnerability allows an attacker who can execute untrusted JavaScript inside the sandbox to achieve arbitrary code execution on the host system. By providing an array value to the require configuration when nested sandboxes are enabled, the attacker can bypass...
CVE-2026-92948
A flaw was found in vm2. This vulnerability allows an attacker with permission to run code inside the sandbox to escape containment and achieve arbitrary code execution on the host system. Due to improper validation of built-in module names, the sandbox fails to block access to sensitive host...
CVE-2026-47698
A flaw was found in vm2. This vulnerability allows arbitrary code execution on the host system through a sandbox breakout. An attacker capable of running code inside the sandbox can manipulate host object properties using indirect function calls to bypass isolation boundaries and execute arbitrar...
CVE-2026-47686
A flaw was found in vm2. The sandbox fails to properly sanitize the error cause property when handling exceptions thrown by host functions. An attacker capable of running untrusted code within the sandbox can exploit this issue to access privileged host objects and bypass isolation boundaries...
ROOT-APP-NPM-CVE-2026-44004 CVE-2026-44004 in vm2 - Patched by Root
Root has patched CVE-2026-44004 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-47137 CVE-2026-47137 in vm2 - Patched by Root
Root has patched CVE-2026-47137 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-47210 CVE-2026-47210 in vm2 - Patched by Root
Root has patched CVE-2026-47210 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-44001 CVE-2026-44001 in vm2 - Patched by Root
Root has patched CVE-2026-44001 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-45411 CVE-2026-45411 in vm2 - Patched by Root
Root has patched CVE-2026-45411 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2023-29199 CVE-2023-29199 in vm2 - Patched by Root
Root has patched CVE-2023-29199 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2022-25893 CVE-2022-25893 in vm2 - Patched by Root
Root has patched CVE-2022-25893 in the vm2 package for Root:npm. Multiple fixed versions available...
ROOT-APP-NPM-CVE-2026-43997 CVE-2026-43997 in vm2 - Patched by Root
Root has patched CVE-2026-43997 in the vm2 package for Root:npm. Multiple fixed versions available...