https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 20:10:40 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-03752 bdu:2023-03752 https://cve.radiocsirt.org/vuln/bdu:2023-03752 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0529 certfr-2024-avi-0529 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0529 https://cve.radiocsirt.org/vuln/euvd-2026-264923 EUVD-2026-264923 https://cve.radiocsirt.org/vuln/euvd-2026-264923 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37466 <p>vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.</p> <p>vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-37466 https://cve.radiocsirt.org/vuln/ghsa-cchq-frgv-rjh5 <p><strong>Affected:</strong> npm: vm2</p> <p>In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.</p> <p>### Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.</p> <p>### Patches None.</p> <p>### Workarounds None.</p> <p>### References PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>- Open an issue in [VM2](https://github.com/patriksimek/vm2)</p> <p>Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.</p> <p><strong>Affected:</strong> npm: vm2</p> <p>In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code.</p> <p>### Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.</p> <p>### Patches None.</p> <p>### Workarounds None.</p> <p>### References PoC - https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9</p> <p>### For more information</p> <p>If you have any questions or comments about this advisory:</p> <p>- Open an issue in [VM2](https://github.com/patriksimek/vm2)</p> <p>Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-cchq-frgv-rjh5 https://cve.radiocsirt.org/vuln/gsd-2023-37466 gsd-2023-37466 https://cve.radiocsirt.org/vuln/gsd-2023-37466 https://cve.radiocsirt.org/vuln/rhsa-2023:4972 <p>openshift: OCP &amp; FIPS mode vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code</p> <p>openshift: OCP &amp; FIPS mode vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code</p> https://cve.radiocsirt.org/vuln/rhsa-2023:4972 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1752 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vm2 ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vm2 ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1752