DeutschShown in its original language — a full translation is planned for a future version.
vm2: Mehrere Schwachstellen
view advisory published 2026-05-18
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und vertrauliche Informationen offenzulegen.
01
describes (11)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-92962US | — | — | ||
vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its outpu… | ||||
| CVE-2026-92956US | critical10.0 | Exploit | ||
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.ins… | ||||
| CVE-2026-47210US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, a sandbox escape vulnerability in vm2 allows arbitrary code execution in the host process when untrusted code… | ||||
| CVE-2026-47209US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the BaseHandler.set trap in bridge.js (line 1231) ignores the receiver parameter and unconditionally writes t… | ||||
| CVE-2026-47208US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from… | ||||
| CVE-2026-47141US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The di… | ||||
| CVE-2026-47140US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM blocks several dangerous Node.js builtins such as module, worker_threads, cluster, vm, repl, and inspe… | ||||
| CVE-2026-47139US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM supports excluding public network builtins from the wildcard builtin option. With this configuration d… | ||||
| CVE-2026-47137US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx (CVE-2023-37903) introduced a check in nodevm.js line 263 that blocks the com… | ||||
| CVE-2026-47135US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, Symbol.for override in setup-sandbox.js only intercepts 2 of 9 dangerous Node.js cross-realm symbols. Combine… | ||||
| CVE-2026-47131US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__… | ||||
02
references
External citations — patches, advisories, analysis.
- Red Hat Security Advisory RHSA-2026:33574 vom 2026-06-30external
- Red Hat Security Advisory RHSA-2026:50850 vom 2026-08-05external
- Red Hat Security Advisory RHSA-2026:76788 vom 2026-10-06external
- Red Hat Security Advisory RHSA-2026:79088 vom 2026-10-08external
- GitHub Security Advisory GHSA-6j2x-vhqr-qr7q vom 2026-05-18external
- GitHub Security Advisory GHSA-76w7-j9cq-rx2j vom 2026-05-18external
- GitHub Security Advisory GHSA-9g8x-92q2-p28f vom 2026-05-18external
- GitHub Security Advisory GHSA-c4cf-2hgv-2qv6 vom 2026-05-18external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan