Most recent entries from all

bdu:2026-14924

2026-10-08T16:00:07.256568+00:00

bdu:2026-14924

fkie_cve-2026-93605

2026-10-08T16:00:07.256615+00:00

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

Withdrawn: GHSA-9hxx-m5g2-2q3h — Duplicate Advisory: vm2 contains a sandbox escape vulnerability

2026-10-08T16:00:07.256654+00:00

Withdrawn by the publisher.

Affected: npm: vm2

# Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-pq68-rvw4-xp4r. This link is maintained to preserve external references.

# Original Description vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

RHSA-2026:76788 — Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.

2026-10-08T16:00:07.256684+00:00

undici: undici: Denial of Service via unrequested WebSocket subprotocol vm2: vm2: Denial of Service due to memory allocation limit bypass vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators urllib: urllib: Credential leakage via cross-origin redirects fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding fast-uri: fast-uri: Host confusion via skipped IDN canonicalization fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects multer: Multer: Denial of Service via file descriptor leak on aborted uploads multer: Multer: Denial of Service via crafted multipart field names jsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressions jsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressions jsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressions multer: Multer: Denial of Service via oversized array index in field names qs: qs: Denial of Service via improper validation in stringify function fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect…