https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-13T08:20:57.123082+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-02869 bdu:2023-02869 2026-10-13T08:20:57.136979+00:00 bdu:2023-02869 https://cve.radiocsirt.org/vuln/euvd-2026-211445 EUVD-2026-211445 2026-10-13T08:20:57.137015+00:00 EUVD-2026-211445 https://cve.radiocsirt.org/vuln/fkie_cve-2023-32314 fkie_cve-2023-32314 2026-10-13T08:20:57.137028+00:00

vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

 https://cve.radiocsirt.org/vuln/ghsa-whpj-8f3w-67p5 GHSA-whpj-8f3w-67p5 — vm2 Sandbox Escape vulnerability 2026-10-13T08:20:57.137060+00:00

Affected: npm: vm2

A sandbox escape vulnerability exists in vm2 for versions up to 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`.

### Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches This vulnerability was patched in the release of version `3.9.18` of `vm2`.

### Workarounds None.

### References PoC - https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2023-32314 gsd-2023-32314 2026-10-13T08:20:57.137092+00:00 gsd-2023-32314 https://cve.radiocsirt.org/vuln/rhsa-2023:3325 RHSA-2023:3325 — Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1.7 security fixes and container updates 2026-10-13T08:20:57.137104+00:00

vm2: Inspect Manipulation vm2: Sandbox Escape

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1217 WID-SEC-W-2023-1217 — vm2: Mehrere Schwachstellen 2026-10-13T08:20:57.137121+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen und um Dateien zu manipulieren.