https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T18:36:12.904982+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-03966 bdu:2023-03966 2026-10-06T18:36:12.925565+00:00 bdu:2023-03966 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0529 certfr-2024-avi-0529 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan… 2026-10-06T18:36:12.925608+00:00 certfr-2024-avi-0529 https://cve.radiocsirt.org/vuln/euvd-2026-258441 EUVD-2026-258441 2026-10-06T18:36:12.925627+00:00 EUVD-2026-258441 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37903 fkie_cve-2023-37903 2026-10-06T18:36:12.925638+00:00

vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.

 https://cve.radiocsirt.org/vuln/ghsa-g644-9gfx-q4q4 GHSA-g644-9gfx-q4q4 — vm2 Sandbox Escape vulnerability 2026-10-06T18:36:12.925668+00:00

Affected: npm: vm2

In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.

### Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.

### Patches None.

### Workarounds None.

### References PoC is to be disclosed on or after the 5th of September.

### Similarity with [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466) While this advisory might look similar to [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466), it is a completely different way of escaping the sandbox.

### For more information If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.

 https://cve.radiocsirt.org/vuln/gsd-2023-37903 gsd-2023-37903 2026-10-06T18:36:12.925700+00:00 gsd-2023-37903 https://cve.radiocsirt.org/vuln/rhsa-2023:4972 RHSA-2023:4972 — Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1.8 security updates and bug fixes 2026-10-06T18:36:12.925711+00:00

openshift: OCP & FIPS mode vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code

 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1863 WID-SEC-W-2023-1863 — vm2: Schwachstelle ermöglicht Codeausführung 2026-10-06T18:36:12.925740+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vm2 ausnutzen, um beliebigen Programmcode auszuführen.