https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 12:59:49 +0000 https://db.gcve.eu/vuln/cve-2026-92948 <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 versions &gt;= 3.9.6 and &lt;= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { builtin: [&#39;node:test&#39;] }). On Node.js 24+, module.builtinModules exposes the scheme-only key node:test, which is not covered by vm2&#39;s family-based DANGEROUS_BUILTINS protection, so it is stored in the generic host-passthrough loader. Because requireImpl() in lib/setup-node-sandbox.js strips a single &#39;node:&#39; prefix before the builtin lookup, sandbox code calling require(&#39;node:node:test&#39;) resolves to the stored node:test key and receives a readonly proxy to the host module. Calls to node:test.run() are forwarded to the host implementation, which spawns a separate Node process for process-isolated test execution and passes through attacker-controlled execArgv values; supplying --eval=&lt;JavaScript&gt; therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7.</p> <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 versions &gt;= 3.9.6 and &lt;= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { builtin: [&#39;node:test&#39;] }). On Node.js 24+, module.builtinModules exposes the scheme-only key node:test, which is not covered by vm2&#39;s family-based DANGEROUS_BUILTINS protection, so it is stored in the generic host-passthrough loader. Because requireImpl() in lib/setup-node-sandbox.js strips a single &#39;node:&#39; prefix before the builtin lookup, sandbox code calling require(&#39;node:node:test&#39;) resolves to the stored node:test key and receives a readonly proxy to the host module. Calls to node:test.run() are forwarded to the host implementation, which spawns a separate Node process for process-isolated test execution and passes through attacker-controlled execArgv values; supplying --eval=&lt;JavaScript&gt; therefore executes arbitrary JavaScript in an unrestricted host Node process outside the NodeVM sandbox. Fixed in vm2 3.11.7.</p> https://db.gcve.eu/vuln/cve-2026-92948