| CVE-2026-100723 |
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength…
|
6.9
Medium
|
Sep 27, 2026 |
| CVE-2026-100722 |
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
|
8.9
High
|
Sep 27, 2026 |
| CVE-2026-100721 |
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
|
9.5
Critical
|
Sep 27, 2026 |
| CVE-2026-93606 |
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
|
10.0
Critical
|
Sep 18, 2026 |
| CVE-2026-93605 |
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits…
|
10.0
Critical
|
Sep 18, 2026 |
| CVE-2026-93604 |
vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly…
|
6.9
Medium
|
Sep 18, 2026 |
| CVE-2026-93603 |
vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge…
|
10.0
Critical
|
Sep 18, 2026 |
| CVE-2026-92962 |
vm2 is a sandbox for running untrusted JavaScript
|
2.1
Low
|
Sep 17, 2026 |
| CVE-2026-92963 |
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL…
|
6.9
Medium
|
Sep 17, 2026 |
| CVE-2026-92961 |
vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors,…
|
8.7
High
|
Sep 17, 2026 |
| CVE-2026-92959 |
vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM
|
7.1
High
|
Sep 17, 2026 |
| CVE-2026-92960 |
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92958 |
vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM
|
8.4
High
|
Sep 17, 2026 |
| CVE-2026-92957 |
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92956 |
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92955 |
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92953 |
vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation
|
9.3
Critical
|
Sep 17, 2026 |
| CVE-2026-92954 |
vm2 is a sandbox library for running untrusted JavaScript in Node.js
|
9.2
Critical
|
Sep 17, 2026 |
| CVE-2026-92952 |
vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary
|
8.9
High
|
Sep 17, 2026 |
| CVE-2026-92950 |
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary…
|
9.3
Critical
|
Sep 17, 2026 |
| CVE-2026-92951 |
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92949 |
vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects,…
|
6.3
Medium
|
Sep 17, 2026 |
| CVE-2026-92947 |
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92948 |
vm2 versions >= 3.9.6…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92946 |
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit…
|
10.0
Critical
|
Sep 17, 2026 |