DeutschShown in its original language — a full translation is planned for a future version.
vm2: Mehrere Schwachstellen
view advisory published 2026-05-03
Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, und um Sicherheitsvorkehrungen zu umgehen.
01
describes (16)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-92963US | medium5.3 | — | ||
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state obje… | ||||
| CVE-2026-44007US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer… | ||||
| CVE-2026-44006US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability… | ||||
| CVE-2026-44005US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2's bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes i… | ||||
| CVE-2026-44003US | medium5.8 | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, i… | ||||
| CVE-2026-44002US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction()… | ||||
| CVE-2026-44001US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a singl… | ||||
| CVE-2026-44000US | high7.2 | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolu… | ||||
| CVE-2026-43999US | —OT elevated | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, NodeVM's builtin allowlist can be bypassed when the module builtin is allowed (including via the '*' wildcard). The m… | ||||
| CVE-2026-43997US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one e… | ||||
| CVE-2026-26956US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host… | ||||
| CVE-2026-26332US | critical10.0 | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in… | ||||
| CVE-2026-24781US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to writ… | ||||
| CVE-2026-24120US | — | — | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can… | ||||
| CVE-2026-24118US | — | Exploit | ||
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from… | ||||
| CVE-2026-22709US | critical10.0 | — | ||
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows… | ||||
02
references
External citations — patches, advisories, analysis.
- Oracle Linux Security Advisory ELSA-2026-7292 vom 2026-05-29external
- Red Hat Security Advisory RHSA-2026:26234 vom 2026-06-16external
- Red Hat Security Advisory RHSA-2026:50850 vom 2026-08-05external
- GitHub Security Advisory GHSA-2cm2-m3w5-gp2f vom 2026-05-03external
- GitHub Security Advisory GHSA-47x8-96vw-5wg6 vom 2026-05-03external
- GitHub Security Advisory GHSA-55hx-c926-fr95 vom 2026-05-03external
- GitHub Security Advisory GHSA-6785-pvv7-mvg7 vom 2026-05-03external
- GitHub Security Advisory GHSA-8hg8-63c5-gwmx vom 2026-05-03external
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan