https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T20:10:43.317696+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-03752 bdu:2023-03752 2026-10-06T20:10:43.328412+00:00 bdu:2023-03752 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0529 certfr-2024-avi-0529 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-06T20:10:43.328458+00:00 certfr-2024-avi-0529 https://cve.radiocsirt.org/vuln/euvd-2026-264923 EUVD-2026-264923 2026-10-06T20:10:43.328478+00:00 EUVD-2026-264923 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37466 fkie_cve-2023-37466 2026-10-06T20:10:43.328491+00:00

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.

 https://cve.radiocsirt.org/vuln/ghsa-cchq-frgv-rjh5 GHSA-cchq-frgv-rjh5 — vm2 Sandbox Escape vulnerability 2026-10-06T20:10:43.328523+00:00

Affected: npm: vm2

In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.

### Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.

### Patches None.

### Workarounds None.

### References PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2023-37466 gsd-2023-37466 2026-10-06T20:10:43.328556+00:00 gsd-2023-37466 https://cve.radiocsirt.org/vuln/rhsa-2023:4972 RHSA-2023:4972 — Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1.8 security updates and bug fixes 2026-10-06T20:10:43.328568+00:00

openshift: OCP & FIPS mode vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1752 WID-SEC-W-2023-1752 — vm2: Schwachstelle ermöglicht Codeausführung 2026-10-06T20:10:43.328592+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vm2 ausnutzen, um beliebigen Programmcode auszuführen.