Most recent entries from all

bdu:2026-14925

fkie_cve-2026-93606

vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer (hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js) only wraps `then`/`catch` rejection slots that hold a function, and the sandbox-side `Symbol.species`/`.then` neutralization is installed only on the sandbox intrinsic `Promise.prototype`, so it never applies to a host Promise. Code running inside the sandbox can overwrite `p.constructor[Symbol.species]` on the host Promise and then call `p.then()` with no `onRejected` handler; V8 substitutes its internal Thrower, which re-throws the raw host rejection value into a resolve/reject closure captured by the attacker. This delivers an unsanitized, fully functional bridge proxy of the host object to sandboxed code, bypassing handleException and hostPromiseSanitizeReject. If the rejection value is host-pivotable (for example a host `process` object), this results in arbitrary code execution on the host. Fixed in 3.12.1.

GHSA-q84h-7qfg-c6j8

RHSA-2026:76788 — Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.

undici: undici: Denial of Service via unrequested WebSocket subprotocol vm2: vm2: Denial of Service due to memory allocation limit bypass vm2: vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE vm2: vm2: Sandbox Breakout Using Dangerous Host Proto Mutators urllib: urllib: Credential leakage via cross-origin redirects fast-uri: fast-uri: Server-Side Request Forgery via repeated hostname percent-decoding fast-uri: fast-uri: Host confusion via skipped IDN canonicalization fast-uri: fast-uri: Server-side request forgery via malformed IPv6 normalization fast-uri: fast-uri: URI parsing flaw enables server-side request forgery and redirects multer: Multer: Denial of Service via file descriptor leak on aborted uploads multer: Multer: Denial of Service via crafted multipart field names jsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressions jsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressions jsonata: JSONata: Arbitrary Code Execution via crafted JSONata expressions multer: Multer: Denial of Service via oversized array index in field names qs: qs: Denial of Service via improper validation in stringify function fast-uri: fast-uri: Authority Injection via Unvalidated Port Serialization js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies undici: undici: TLS certificate validation bypass in BalancedPool via dropped connect…