{"kind": "product", "path": "vulns/npm/vm2", "name": "vm2", "product": "vm2", "ecosystem": "npm", "items": [{"id": "CVE-2026-100723", "noindex": false, "published": "2026-09-27T01:28:30.027Z", "modified": "2026-10-01T18:04:57.414Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N", "severity": "medium", "epss": 0.00316, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-100723", "title": "vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool", "description": "vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm mem", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-489w-w794-jq94", "https://github.com/patriksimek/vm2/commit/4f2508abeb252aa86eb6761c78b3b000248fb089", "https://github.com/patriksimek/vm2/commit/5214b02ef13b82497fcb917b45320dfd014ffd09"], "fixes": ["3.12.2"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-100722", "noindex": false, "published": "2026-09-27T01:28:29.295Z", "modified": "2026-09-28T13:51:49.241Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.0026, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-100722", "title": "vm2 before 3.12.2 Host Process Termination via Construct Trap", "description": "vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminate", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-2v2p-6j97-cjg9", "https://www.vulncheck.com/advisories/vm2-before-3.12.2-host-process-termination-via-construct-trap", "https://nvd.nist.gov/vuln/detail/CVE-2026-100722"], "fixes": ["3.12.2"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-100721", "noindex": false, "published": "2026-09-27T01:28:28.596Z", "modified": "2026-09-28T16:51:10.611Z", "cvss": 9.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.004, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-100721", "title": "vm2 before 3.12.2 Authorization Bypass via Custom Resolver", "description": "vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sib", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-5h3f-q97h-ccvc", "https://github.com/patriksimek/vm2/commit/6ac3916da84e060c403e407b6b6318fcc66b0e72", "https://github.com/patriksimek/vm2/commit/ab4ee7d803e8c80155e9eb3672226bddbca4aa9c"], "fixes": ["3.12.2"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-93605", "noindex": false, "published": "2026-09-18T13:20:14.332Z", "modified": "2026-09-21T20:51:52.937Z", "cvss": 10, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00726, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-93605", "title": "vm2 NodeVM before 3.12.1 Remote Code Execution via child_process", "description": "vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-pq68-rvw4-xp4r", "https://www.vulncheck.com/advisories/vm2-nodevm-before-3.12.1-remote-code-execution-via-child-process", "https://nvd.nist.gov/vuln/detail/CVE-2026-93605"], "fixes": ["3.12.1"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92963", "noindex": false, "published": "2026-09-17T13:46:18.972Z", "modified": "2026-09-18T19:15:28.242Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00343, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92963", "title": "vm2 before 3.11.2 Information Disclosure via Internal State", "description": "vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f", "https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state", "https://nvd.nist.gov/vuln/detail/CVE-2026-92963"], "fixes": ["3.11.2"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92962", "noindex": false, "published": "2026-09-17T13:46:18.295Z", "modified": "2026-09-17T15:40:44.491Z", "cvss": 2.1, "cvss_vector": "CVSS:4.0/AV:L/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N", "severity": "low", "epss": 0.00155, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92962", "title": "vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js", "description": "vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment (lines[lines.length] = value) rather than a prototype-bypassing define-property primitive. Because this bridge-internal array is allocated in the sandbox realm, code inside the sandbox can install an accessor on Array.prototype for the relevant index; the accessor is then invoked whenever the sandbox reads error.stack (or otherwise triggers Error.prepareStackTrace), allowing sandbox code to observe and intercept each ", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-q3fm-4wcw-g57x", "https://www.vulncheck.com/advisories/vm2-before-3.11.4-defense-invariant-violation-via-setup-sandbox-js", "https://nvd.nist.gov/vuln/detail/CVE-2026-92962"], "fixes": ["3.11.4"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92961", "noindex": false, "published": "2026-09-17T13:46:17.621Z", "modified": "2026-09-21T20:52:43.708Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00533, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92961", "title": "vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass", "description": "vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust host process memory and trigger out-of-memory conditions.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-v836-6xw4-9cx3", "https://www.vulncheck.com/advisories/vm2-before-3.11.6-memory-exhaustion-dos-via-bufferalloclimit-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-92961"], "fixes": ["3.11.6"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92960", "noindex": false, "published": "2026-09-17T13:46:16.952Z", "modified": "2026-09-17T14:22:01.645Z", "cvss": 10, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L", "severity": "critical", "epss": 0.00474, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92960", "title": "vm2 before 3.11.6 Process-wide State Exposure via os and dns", "description": "vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology. Attackers can invoke dns.setServers() to hijack the host process DNS resolver globally, redirecting all subsequent host DNS queries through an attacker-controlled resolver.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-m5w8-4gq2-6f8x", "https://www.vulncheck.com/advisories/vm2-before-3.11.6-process-wide-state-exposure-via-os-and-dns", "https://nvd.nist.gov/vuln/detail/CVE-2026-92960"], "fixes": ["3.11.6"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92959", "noindex": false, "published": "2026-09-17T13:46:16.252Z", "modified": "2026-09-21T20:41:28.710Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00449, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92959", "title": "vm2 before 3.11.8 allowAsync Bypass via Promise Thenable", "description": "vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code's then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has re", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-f8gf-w286-fmq2", "https://www.vulncheck.com/advisories/vm2-before-3.11.8-allowasync-bypass-via-promise-thenable", "https://nvd.nist.gov/vuln/detail/CVE-2026-92959"], "fixes": ["3.11.8"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92958", "noindex": false, "published": "2026-09-17T13:46:15.549Z", "modified": "2026-09-18T19:35:47.679Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L", "severity": "high", "epss": 0.00384, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92958", "title": "vm2 before 3.11.7 Denylist Bypass via fs/promises", "description": "vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries (e.g. require: { builtin: ['*', '-fs', '-child_process'] }), negative entries are matched by exact module name in lib/builtin.js, so -fs removes only the builtin named fs and does not remove builtin subpaths such as fs/promises. Sandboxed code can therefore call require('fs/promises') or require('node:fs/promises') and reach the promise-based filesystem API despite fs being denied; node: prefix handling is likewise inconsistent (a -node:fs/promises entry does not block require('fs/promises')). Host", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-6rh5-qq4q-97xh", "https://www.vulncheck.com/advisories/vm2-before-3.11.7-denylist-bypass-via-fs-promises", "https://nvd.nist.gov/vuln/detail/CVE-2026-92958"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92957", "noindex": false, "published": "2026-09-17T13:46:14.875Z", "modified": "2026-09-26T13:30:01.519Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00537, "kev": false, "exploits": [], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92957", "title": "vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix", "description": "vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-node:child_process'] } })` fails to deny the canonical `child_process` module. Sandboxed code can therefore obtain the host `child_process` builtin via `require('child_process')` or `require('node:child_process')`, gaining references to process-spawn", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-8686-vhfx-7r3j", "https://www.vulncheck.com/advisories/vm2-before-3.11.7-authentication-bypass-via-node-prefix", "https://nvd.nist.gov/vuln/detail/CVE-2026-92957"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92956", "noindex": false, "published": "2026-09-17T13:46:14.202Z", "modified": "2026-09-17T19:20:26.124Z", "cvss": 10, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00587, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92956", "title": "vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming", "description": "vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the host error constructor to the host Function constructor, and recovers the real host `process` object, gaining host Node.js capabilities (e.g. access to host modules such as fs) in the context of the process running the sandbox. No NodeVM, require perm", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-wjwh-qqvp-g4p4", "https://www.vulncheck.com/advisories/vm2-3.10.1-through-3.11.6-sandbox-escape-via-webassembly-compilestreaming", "https://nvd.nist.gov/vuln/detail/CVE-2026-92956"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92955", "noindex": false, "published": "2026-09-17T13:46:13.508Z", "modified": "2026-09-17T14:23:35.469Z", "cvss": 10, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00712, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92955", "title": "vm2 before 3.11.8 Sandbox Escape via NodeVM", "description": "vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-88hf-g992-jg85", "https://www.vulncheck.com/advisories/vm2-before-3.11.8-sandbox-escape-via-nodevm", "https://nvd.nist.gov/vuln/detail/CVE-2026-92955"], "fixes": ["3.11.8"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92954", "noindex": false, "published": "2026-09-17T13:46:12.820Z", "modified": "2026-09-26T13:30:00.813Z", "cvss": 9.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H", "severity": "critical", "epss": 0.00488, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92954", "title": "vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise", "description": "vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wrapped with a rejection-swallowing handler (lib/setup-sandbox.js), and the bridge only installs host-side rejection sanitizers when sandbox code calls .then/.catch/.finally. As a result, code running in the sandbox can invoke a host function that returns a rejected Promise (for example events.once() exposed via the NodeVM events builtin, or any embedder-provided Promise-returning API) and ", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-gjq8-xm47-88rc", "https://www.vulncheck.com/advisories/vm2-3.10.0-through-3.11.5-denial-of-service-via-host-promise", "https://nvd.nist.gov/vuln/detail/CVE-2026-92954"], "fixes": ["3.11.8"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92953", "noindex": false, "published": "2026-09-17T13:46:12.146Z", "modified": "2026-09-18T19:49:31.925Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H", "severity": "critical", "epss": 0.00501, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92953", "title": "vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray", "description": "vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr", "https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray", "https://nvd.nist.gov/vuln/detail/CVE-2026-92953"], "fixes": ["3.11.8"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92952", "noindex": false, "published": "2026-09-17T13:46:11.469Z", "modified": "2026-09-17T15:44:51.213Z", "cvss": 8.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:H/SA:N", "severity": "high", "epss": 0.00461, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92952", "title": "vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass", "description": "vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/setup-sandbox.js and the cross-realm symbol checks and write traps in lib/bridge.js use a fixed list of known dangerous registered symbols that omits nodejs.stream.disturbed and nodejs.stream.errored, which are exposed on host WebStream prototypes on newer Node.js releases (validated on Node.js v25.8.0). When the embedder exposes a host WebStream object and the host stream/web module to the sandbox, sandbox code can obtain the real host symbols via Object.getOwnPropertySymbols(streamWeb.Readable", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-jf8q-945g-9q4c", "https://www.vulncheck.com/advisories/vm2-3.11.4-through-3.11.6-sandbox-symbol-filtering-bypass", "https://nvd.nist.gov/vuln/detail/CVE-2026-92952"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92951", "noindex": false, "published": "2026-09-17T13:46:10.792Z", "modified": "2026-09-17T19:20:34.322Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00539, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92951", "title": "vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver", "description": "vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93", "https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver", "https://nvd.nist.gov/vuln/detail/CVE-2026-92951"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92950", "noindex": false, "published": "2026-09-17T13:46:10.113Z", "modified": "2026-09-17T14:24:26.002Z", "cvss": 9.3, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00197, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92950", "title": "vm2 before 3.11.7 Sandbox Escape via CLI require", "description": "vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process. Attackers can supply a malicious script file to the vm2 CLI that uses require(__filename) to re-execute itself in the host realm, bypassing sandbox isolation and accessing host modules like fs and child_process.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-jxxv-8r27-vm4p", "https://www.vulncheck.com/advisories/vm2-before-3.11.7-sandbox-escape-via-cli-require", "https://nvd.nist.gov/vuln/detail/CVE-2026-92950"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92949", "noindex": false, "published": "2026-09-17T13:46:09.471Z", "modified": "2026-09-21T17:14:33.106Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92949", "title": "vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor", "description": "vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-633r-hq9m-c4ff", "https://www.vulncheck.com/advisories/vm2-3.9.6-before-3.11.7-sandbox-bypass-via-accessor-descriptor", "https://nvd.nist.gov/vuln/detail/CVE-2026-92949"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}, {"id": "CVE-2026-92948", "noindex": false, "published": "2026-09-17T13:46:08.814Z", "modified": "2026-09-18T19:31:54.395Z", "cvss": 9.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H", "severity": "critical", "epss": 0.00654, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "node", "path": "vulns/stack/node", "slug": "node"}], "path": "vulns/cve-2026-92948", "title": "vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test", "description": "vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder explicitly allows the node:test builtin (e.g. require: { builtin: ['node:test'] }). On Node.js 24+, module.builtinModules exposes the scheme-only key node:test, which is not covered by vm2's family-based DANGEROUS_BUILTINS protection, so it is stored in the generic host-passthrough loader. Because requireImpl() in lib/setup-node-sandbox.js strips a single 'node:' prefix before the builtin lookup, sandbox code calling require('node:node:test') resolves to the stored node:test key and rece", "references": ["https://github.com/patriksimek/vm2/security/advisories/GHSA-qhwx-74w5-xhxq", "https://www.vulncheck.com/advisories/vm2-3.9.6-through-3.11.5-sandbox-escape-via-node-test", "https://nvd.nist.gov/vuln/detail/CVE-2026-92948"], "fixes": ["3.11.7"], "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}]}], "total": 78, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 4, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "vm2", "path": "vulns/npm/vm2", "ecosystem": "npm"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["3.12.1", "3.11.8", "3.11.7", "3.11.6", "3.11.4", "3.11.3", "3.11.2", "3.11.1", "3.11.0", "3.10.5", "3.10.2", "3.10.0"], "stats": {"recent": 3, "kev": 0}, "lastmod": "2026-10-01T18:04:57.414Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}