https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 06:27:06 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-06428 bdu:2026-06428 https://cve.radiocsirt.org/vuln/bdu:2026-06428 https://cve.radiocsirt.org/vuln/euvd-2026-337434 EUVD-2026-337434 https://cve.radiocsirt.org/vuln/euvd-2026-337434 https://cve.radiocsirt.org/vuln/fkie_cve-2026-26956 <p>vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.</p> <p>vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-26956 https://cve.radiocsirt.org/vuln/ghsa-ffh4-j6h5-pg66 <p><strong>Affected:</strong> npm: vm2</p> <p>## Summary</p> <p>Full sandbox escape with arbitrary code execution. Attacker code inside `VM.run()` obtains host process object and runs host commands with zero host cooperation.</p> <p>## Details</p> <p>**Confirmed on:** vm2 3.10.4, Node.js v25.6.1 (x64 Linux) **Trigger:** Attacker-controlled code passed to `VM.run()` **Requires:** Node.js version with WebAssembly exception handling + JSTag support (tested on v25.6.1)</p> <p>vm2&#39;s sandbox security relies on two JavaScript-level mechanisms: (1) a code transformer that injects `handleException()` into JS `catch` clauses to wrap host-realm errors, and (2) bridge Proxies that wrap cross-context objects. Both operate entirely within JavaScript.</p> <p>WebAssembly&#39;s `try_table` instruction with a `JSTag` catch handler catches JavaScript exceptions at V8&#39;s C++ level — below JavaScript entirely. When an imported JS function throws a TypeError produced by Symbol-to-string coercion during stack formatting (`e.name = Symbol(); e.stack`), the WASM `try_table` catches it as an opaque `externref` and returns it as a normal function return value. This WASM exception-handling-to-return-value path is not sanitized by vm2 — the host-realm TypeError reaches attacker code unsanitized. Its constructor chain (`hostError.constructor.constructor`) resolves to a Function that returns the host process object, allowing for reflection outside of the vm2 context, leading to code execution.</p> <p>## PoC</p> <p>```js const { VM } = require(&#34;vm2&#34;); console.log(&#34;vm2:&#34;, require(&#34;vm2/package.json&#34;…</p> <p><strong>Affected:</strong> npm: vm2</p> <p>## Summary</p> <p>Full sandbox escape with arbitrary code execution. Attacker code inside `VM.run()` obtains host process object and runs host commands with zero host cooperation.</p> <p>## Details</p> <p>**Confirmed on:** vm2 3.10.4, Node.js v25.6.1 (x64 Linux) **Trigger:** Attacker-controlled code passed to `VM.run()` **Requires:** Node.js version with WebAssembly exception handling + JSTag support (tested on v25.6.1)</p> <p>vm2&#39;s sandbox security relies on two JavaScript-level mechanisms: (1) a code transformer that injects `handleException()` into JS `catch` clauses to wrap host-realm errors, and (2) bridge Proxies that wrap cross-context objects. Both operate entirely within JavaScript.</p> <p>WebAssembly&#39;s `try_table` instruction with a `JSTag` catch handler catches JavaScript exceptions at V8&#39;s C++ level — below JavaScript entirely. When an imported JS function throws a TypeError produced by Symbol-to-string coercion during stack formatting (`e.name = Symbol(); e.stack`), the WASM `try_table` catches it as an opaque `externref` and returns it as a normal function return value. This WASM exception-handling-to-return-value path is not sanitized by vm2 — the host-realm TypeError reaches attacker code unsanitized. Its constructor chain (`hostError.constructor.constructor`) resolves to a Function that returns the host process object, allowing for reflection outside of the vm2 context, leading to code execution.</p> <p>## PoC</p> <p>```js const { VM } = require(&#34;vm2&#34;); console.log(&#34;vm2:&#34;, require(&#34;vm2/package.json&#34;…</p> https://cve.radiocsirt.org/vuln/ghsa-ffh4-j6h5-pg66 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1349 <p>Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1349