Skip to content
OpenAdvisories
Critical WID-SEC-2026-2865 4 CVEs

vm2: Mehrere Schwachstellen

Published Aug 16, 2026 · Updated Oct 27, 2026 · Revision 6 · de-DE

Vendor: Red Hat Product: Enterprise Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um einen Denial of Service Angriff durchzuführen, um beliebigen Programmcode auszuführen, um Informationen offenzulegen, und um Daten zu manipulieren.

Product

vm2 ist eine Sandbox, in der nicht vertrauenswürdiger Code der in Node integrierten Module ausgeführt werden kann.

Vulnerabilities 4

  • Critical 9.9
    CVE-2026-47686

    vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, handleException() in lib/setup-sandbox.js sanitizes SuppressedError.error, SuppressedError.suppressed, and AggregateError.errors but does not sanitize Error.cause, allowing sandbox code to obtain …

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2026-47698

    vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever …

    patriksimek vm2 vm2 npm
  • High 8.7
    CVE-2026-47683

    vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

    vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perf…

    patriksimek vm2 vm2 npm
  • High 7.5
    CVE-2026-92961

    vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

    vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary host memory. Attackers can bypass the buffer allocation cap by using these V8 intrinsics to exhaust ho…

    patriksimek vm2 vm2 npm

Revision history

  1. #6

    Neue Updates von Red Hat aufgenommen

  2. #5

    Neue Updates von Red Hat aufgenommen

  3. #4

    Neue Updates von Red Hat aufgenommen

  4. #3

    CVE ergänzt

  5. #2

    Referenz(en) aufgenommen: EUVD-2026-60461, EUVD-2026-60460, EUVD-2026-60459

  6. #1

    Initiale Fassung

References