Skip to content
OpenAdvisories
Critical WID-SEC-2026-3594 3 CVEs

vm2: Mehrere Schwachstellen

Published Sep 27, 2026 · Updated Sep 27, 2026 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen, Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand auszulösen.

Product

vm2 ist eine Sandbox, in der nicht vertrauenswürdiger Code der in Node integrierten Module ausgeführt werden kann.

Vulnerabilities 3

  • Critical 9.0
    CVE-2026-100721 Public exploit

    vm2 before 3.12.2 Authorization Bypass via Custom Resolver

    vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the reso…

    patriksimek vm2 vm2 npm
  • High 7.5
    CVE-2026-100723

    vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

    vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin…

    patriksimek vm2 vm2 npm
  • Medium 6.8
    CVE-2026-100722

    vm2 before 3.12.2 Host Process Termination via Construct Trap

    vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.con…

    patriksimek vm2 vm2 npm

Revision history

  1. #1

    Initiale Fassung

References