https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 01:49:54 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-14942 bdu:2026-14942 https://cve.radiocsirt.org/vuln/bdu:2026-14942 https://cve.radiocsirt.org/vuln/euvd-2026-370754 EUVD-2026-370754 https://cve.radiocsirt.org/vuln/euvd-2026-370754 https://cve.radiocsirt.org/vuln/fkie_cve-2026-92947 <p>vm2 before 3.11.7 exposes Node&#39;s shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.</p> <p>vm2 before 3.11.7 exposes Node&#39;s shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-92947 https://cve.radiocsirt.org/vuln/ghsa-fcqc-726x-5wfc <p><strong>Affected:</strong> npm: vm2</p> <p>### Summary Sandboxed code is able to disclose host memory used by small allocations by `Buffer.from`, `Buffer.concat`.</p> <p>### Details vm2 exposes `Buffer` object to sandboxed code by default. Small [`Buffer` allocations](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize) (for example, [Buffer.allocUnsafe()](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize), [Buffer.from(array)](https://nodejs.org/api/buffer.html#static-method-bufferfromarray), [Buffer.from(string)](https://nodejs.org/api/buffer.html#static-method-bufferfromstring-encoding), and [Buffer.concat()](https://nodejs.org/api/buffer.html#static-method-bufferconcatlist-totallength)) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.</p> <p>### PoC Tested against `vm2@3.11.5` in the node REPL. ```javascript Buffer.from(&#39;host-memory-should-not-leak-to-sandbox&#39;) new (require(&#39;vm2&#39;).VM)().run(`Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString(&#39;ascii&#39;)`) ```</p> <p>&lt;img width=&#34;1044&#34; height=&#34;104&#34; alt=&#34;Screenshot 2026-07-23 at 17 54 15&#34; src=&#34;https://github.com/user-attachments/assets/987b860c-6702-4818-bfaa-c77919c777e5&#34; /&gt;</p> <p>### Impact Since sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-o…</p> <p><strong>Affected:</strong> npm: vm2</p> <p>### Summary Sandboxed code is able to disclose host memory used by small allocations by `Buffer.from`, `Buffer.concat`.</p> <p>### Details vm2 exposes `Buffer` object to sandboxed code by default. Small [`Buffer` allocations](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize) (for example, [Buffer.allocUnsafe()](https://nodejs.org/api/buffer.html#static-method-bufferallocunsafesize), [Buffer.from(array)](https://nodejs.org/api/buffer.html#static-method-bufferfromarray), [Buffer.from(string)](https://nodejs.org/api/buffer.html#static-method-bufferfromstring-encoding), and [Buffer.concat()](https://nodejs.org/api/buffer.html#static-method-bufferconcatlist-totallength)) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.</p> <p>### PoC Tested against `vm2@3.11.5` in the node REPL. ```javascript Buffer.from(&#39;host-memory-should-not-leak-to-sandbox&#39;) new (require(&#39;vm2&#39;).VM)().run(`Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString(&#39;ascii&#39;)`) ```</p> <p>&lt;img width=&#34;1044&#34; height=&#34;104&#34; alt=&#34;Screenshot 2026-07-23 at 17 54 15&#34; src=&#34;https://github.com/user-attachments/assets/987b860c-6702-4818-bfaa-c77919c777e5&#34; /&gt;</p> <p>### Impact Since sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-o…</p> https://cve.radiocsirt.org/vuln/ghsa-fcqc-726x-5wfc https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2997 <p>Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen und um beliebigen Programmcode auszuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen und um beliebigen Programmcode auszuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2997