| CVE-2026-92944 |
vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where…
|
9.3
Critical
|
Sep 17, 2026 |
| CVE-2026-92945 |
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix…
|
2.3
Low
|
Sep 17, 2026 |
| CVE-2026-92942 |
vm2 before 3.11.7 (affected…
|
8.7
High
|
Sep 17, 2026 |
| CVE-2026-92940 |
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92941 |
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92939 |
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92937 |
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92938 |
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92936 |
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting
|
6.9
Medium
|
Sep 17, 2026 |
| CVE-2026-92934 |
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited…
|
9.5
Critical
|
Sep 17, 2026 |
| CVE-2026-92935 |
vm2 is a sandbox for running untrusted Node.js code
|
9.5
Critical
|
Sep 17, 2026 |
| CVE-2026-92933 |
vm2 is a sandbox for running untrusted Node.js code
|
6.9
Medium
|
Sep 17, 2026 |
| CVE-2026-47683 |
vm2 is an open source vm/sandbox for Node.js
|
8.7
High
|
Aug 17, 2026 |
| CVE-2026-47686 |
vm2 is an open source vm/sandbox for Node.js
|
9.9
Critical
|
Aug 17, 2026 |
| CVE-2026-47698 |
vm2 is an open source vm/sandbox for Node.js
|
9.8
Critical
|
Aug 17, 2026 |
| CVE-2026-47141 |
vm2 is an open source vm/sandbox for Node.js
|
6.9
Medium
|
Jun 12, 2026 |
| CVE-2026-47210 |
vm2 is an open source vm/sandbox for Node.js
|
9.8
Critical
|
Jun 12, 2026 |
| CVE-2026-47208 |
vm2 is an open source vm/sandbox for Node.js
|
10.0
Critical
|
Jun 12, 2026 |
| CVE-2026-47140 |
vm2 is an open source vm/sandbox for Node.js
|
10.0
Critical
|
Jun 12, 2026 |
| CVE-2026-47139 |
vm2 is an open source vm/sandbox for Node.js
|
8.6
High
|
Jun 12, 2026 |
| CVE-2026-47137 |
vm2 is an open source vm/sandbox for Node.js
|
10.0
Critical
|
Jun 12, 2026 |
| CVE-2026-47135 |
vm2 is an open source vm/sandbox for Node.js
|
8.7
High
|
Jun 12, 2026 |
| CVE-2026-47131 |
vm2 is an open source vm/sandbox for Node.js
|
10.0
Critical
|
Jun 12, 2026 |
| CVE-2026-47209 |
vm2 is an open source vm/sandbox for Node.js
|
8.6
High
|
Jun 12, 2026 |
| CVE-2026-44005 |
vm2 is an open source vm/sandbox for Node.js
|
10.0
Critical
|
May 13, 2026 |