🔔 Premium Features
🔍 Filter Threats
| Title | Severity | PoC | Actively Exploited | Source | Date |
|---|---|---|---|---|---|
| CVE-2026-92956 vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compil... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92954 vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-w... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92952 vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in lib/... | MEDIUM | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92951 vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching ins... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92950 vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process.... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92949 vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass ... | MEDIUM | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92948 vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92947 vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92945 vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-... | MEDIUM | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92944 vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper ... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92942 vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call.... | HIGH | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() an... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to a... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92939 vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92938 vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either expl... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92937 vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomple... | CRITICAL | ????? | ????? | NVD | 5 days ago |
| CVE-2026-92936 vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can fo... | MEDIUM | ????? | ????? | NVD | 5 days ago |