https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 18:36:05 +0000 https://cve.radiocsirt.org/vuln/bdu:2023-03966 bdu:2023-03966 https://cve.radiocsirt.org/vuln/bdu:2023-03966 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0529 certfr-2024-avi-0529 https://cve.radiocsirt.org/vuln/certfr-2024-avi-0529 https://cve.radiocsirt.org/vuln/euvd-2026-258441 EUVD-2026-258441 https://cve.radiocsirt.org/vuln/euvd-2026-258441 https://cve.radiocsirt.org/vuln/fkie_cve-2023-37903 <p>vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.</p> <p>vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2023-37903 https://cve.radiocsirt.org/vuln/ghsa-g644-9gfx-q4q4 <p><strong>Affected:</strong> npm: vm2</p> <p>In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.</p> <p>### Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.</p> <p>### Patches None.</p> <p>### Workarounds None.</p> <p>### References PoC is to be disclosed on or after the 5th of September.</p> <p>### Similarity with [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466) While this advisory might look similar to [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466), it is a completely different way of escaping the sandbox.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Open an issue in [VM2](https://github.com/patriksimek/vm2)</p> <p>Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.</p> <p><strong>Affected:</strong> npm: vm2</p> <p>In vm2 for versions up to 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code.</p> <p>### Impact Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.</p> <p>### Patches None.</p> <p>### Workarounds None.</p> <p>### References PoC is to be disclosed on or after the 5th of September.</p> <p>### Similarity with [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466) While this advisory might look similar to [CVE-2023-37466](https://nvd.nist.gov/vuln/detail/CVE-2023-37466), it is a completely different way of escaping the sandbox.</p> <p>### For more information If you have any questions or comments about this advisory:</p> <p>- Open an issue in [VM2](https://github.com/patriksimek/vm2)</p> <p>Thanks to [Xion](https://twitter.com/0x10n) (SeungHyun Lee) of [KAIST Hacking Lab](https://kaist-hacking.github.io/) for disclosing this vulnerability.</p> https://cve.radiocsirt.org/vuln/ghsa-g644-9gfx-q4q4 https://cve.radiocsirt.org/vuln/gsd-2023-37903 gsd-2023-37903 https://cve.radiocsirt.org/vuln/gsd-2023-37903 https://cve.radiocsirt.org/vuln/rhsa-2023:4972 <p>openshift: OCP &amp; FIPS mode vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code</p> <p>openshift: OCP &amp; FIPS mode vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code</p> https://cve.radiocsirt.org/vuln/rhsa-2023:4972 https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1863 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vm2 ausnutzen, um beliebigen Programmcode auszuführen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in vm2 ausnutzen, um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2023-1863