https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 23:56:23 +0000 https://db.gcve.eu/vuln/cve-2026-100723 <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node&#39;s zlib module through NodeVM&#39;s builtin allowlist (require: { builtin: [&#39;zlib&#39;] }), zlib.deflateSync can return a Buffer backed by Node&#39;s shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.</p> <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node&#39;s zlib module through NodeVM&#39;s builtin allowlist (require: { builtin: [&#39;zlib&#39;] }), zlib.deflateSync can return a Buffer backed by Node&#39;s shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.</p> https://db.gcve.eu/vuln/cve-2026-100723