https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 16:05:48 +0000 https://vulnerability.circl.lu/vuln/bdu:2026-14924 bdu:2026-14924 https://vulnerability.circl.lu/vuln/bdu:2026-14924 https://vulnerability.circl.lu/vuln/fkie_cve-2026-93605 <p>vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:[&#39;*&#39;] or explicit child_process allowance.</p> <p>vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:[&#39;*&#39;] or explicit child_process allowance.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-93605 https://vulnerability.circl.lu/vuln/ghsa-9hxx-m5g2-2q3h <p>vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:[&#39;*&#39;] or explicit child_process allowance.</p> <p>vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:[&#39;*&#39;] or explicit child_process allowance.</p> https://vulnerability.circl.lu/vuln/ghsa-9hxx-m5g2-2q3h