DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
vm2: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-24
Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen und um beliebigen Programmcode auszuführen.
01
beschreibt (18)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-92958US | high8.5 | — | ||
vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '… | ||||
| CVE-2026-92957US | critical9.9 | — | ||
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM… | ||||
| CVE-2026-92952US | medium6.8 | — | ||
vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross… | ||||
| CVE-2026-92951US | critical9.9OT erhöht | — | ||
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boun… | ||||
| CVE-2026-92950US | —OT erhöht | — | ||
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malici… | ||||
| CVE-2026-92949US | medium4.0 | — | ||
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly()… | ||||
| CVE-2026-92948US | critical9.9 | — | ||
vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the… | ||||
| CVE-2026-92947US | critical10.0 | — | ||
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed cod… | ||||
| CVE-2026-92946US | critical10.0 | — | ||
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can re… | ||||
| CVE-2026-92945US | —OT erhöht | — | ||
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers… | ||||
| CVE-2026-92944US | critical9.8 | — | ||
vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseT… | ||||
| CVE-2026-92942US | high7.5 | — | ||
vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call. The timeout only wraps the singl… | ||||
| CVE-2026-92941US | critical10.0 | — | ||
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certifi… | ||||
| CVE-2026-92940US | critical10.0 | — | ||
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin… | ||||
| CVE-2026-92939US | — | — | ||
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, bu… | ||||
| CVE-2026-92938US | critical9.9 | — | ||
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. T… | ||||
| CVE-2026-92937US | critical10.0 | — | ||
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bri… | ||||
| CVE-2026-92935US | critical9.0 | Exploit | ||
vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'objec… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:76788 vom 2026-10-06external
- Red Hat Security Advisory RHSA-2026:79088 vom 2026-10-08external
- vm2 release 3.11.7 vom 2026-08-24external
- GitHub Security Advisory GHSA-27g9-p43v-cw3v vom 2026-08-24external
- GitHub Security Advisory GHSA-46pr-c5wc-xffx vom 2026-08-24external
- GitHub Security Advisory GHSA-633r-hq9m-c4ff vom 2026-08-24external
- GitHub Security Advisory GHSA-647f-g98j-qq25 vom 2026-08-24external
- GitHub Security Advisory GHSA-6rh5-qq4q-97xh vom 2026-08-24external
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan