Skip to content
OpenAdvisories
Critical WID-SEC-2026-3071 7 CVEs

vm2: Mehrere Schwachstellen

Published Aug 27, 2026 · Updated Oct 27, 2026 · Revision 6 · de-DE

Vendor: Red Hat Product: Enterprise Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode mit den Rechten des Dienstes auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.

Product

vm2 ist eine Sandbox, in der nicht vertrauenswürdiger Code der in Node integrierten Module ausgeführt werden kann.

Vulnerabilities 7

  • Critical 10.0
    CVE-2026-92953

    vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

    vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prot…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2026-92955

    vm2 before 3.11.8 Sandbox Escape via NodeVM

    vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to…

    patriksimek vm2 vm2 npm
  • Critical 9.0
    CVE-2026-92934

    vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

    vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in han…

    patriksimek vm2 vm2 npm
  • High 8.6
    CVE-2026-92954

    vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise

    vm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into the sandbox are not marked as handled at the bridge boundary; only Promises created inside the sandbox are wr…

    patriksimek vm2 vm2 npm
  • High 7.1
    CVE-2026-92959

    vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

    vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws 'Async not available', the sandbox's Promise static methods (Promise.resolve, Promise.all, Promise…

    patriksimek vm2 vm2 npm
  • Medium 5.8
    CVE-2026-92933

    vm2 before 3.11.8 Information Disclosure via util.getCallSites

    vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alia…

    patriksimek vm2 vm2 npm
  • Medium 5.8
    CVE-2026-92936

    vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

    vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval with malformed sour…

    patriksimek vm2 vm2 npm

Revision history

  1. #6

    Neue Updates von Red Hat aufgenommen

  2. #5

    Neue Updates von Red Hat aufgenommen

  3. #4

    Neue Updates von Red Hat aufgenommen

  4. #3

    CVE-Nummern ergänzt

  5. #2

    CVE's ergänzt

  6. #1

    Initiale Fassung

References