Cyber Security Daily Radar

#advisory

共收录 23210 条相关情报。

← 返回所有主题
安全公告2026-10-01 发布INFO

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

CVE-2026-73605

### Summary `/api/file/getUniqueFilename` takes a path from the request body and passes it to a filesystem existence ch

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-10-01 发布INFO

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

CVE-2026-73607

### Summary `/api/storage/getOutlineStorage` is registered with `CheckAuth` only and performs no authorization of any k

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#go#cwe-862#severity:medium
安全公告2026-10-01 发布INFO

vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

CVE-2026-92952

## Summary vm2 current head (`v3.11.5`, commit `7a1f5100b96f48d34e0fe104ab37c0acc5944f92`) still exposes registered Nod

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-669#severity:medium
安全公告2026-10-01 发布INFO

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

CVE-2026-92948

## Summary On Node.js 24 and newer, `vm2` can expose the host `node:test` module to sandboxed `NodeVM` code when the em

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-693#severity:critical
安全公告2026-10-01 发布INFO

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

CVE-2026-92950

### Summary The `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's "CLI" section r

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-453#cwe-829#cwe-1188#severity:high
安全公告2026-10-01 发布INFO

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

CVE-2026-92940

Summary vm2 3.11.6 exposes the host process's real `https.globalAgent` when a `NodeVM` is explicitly allowed to require

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-668#severity:critical
安全公告2026-10-01 发布INFO

Classroom 50 vulnerable to arbitrary file overwrite on the teacher's machine via symlink in a student repo (gh teacher download)

CVE-2026-94620

Classroom 50 is a free and open-source tool for managing and grading programming assignments via GitHub. Prior to versio

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-22#cwe-59
安全公告2026-10-01 发布INFO

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

CVE-2026-92951

### Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-706#cwe-829#cwe-863#severity:critical
安全公告2026-10-01 发布INFO

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

CVE-2026-92958

## Summary NodeVM's builtin wildcard policy can allow sandboxed code to access `fs/promises` even when the embedder den

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-269#cwe-284#severity:high
安全公告2026-10-01 发布INFO

AWS EFS CSI Driver Mount Option Injection via mounttargetipmap

CVE-2026-103505

Improper neutralization of argument delimiters in the volume handling component in AWS EFS CSI Driver (aws-efs-csi-drive

历史摘要 · 未重新核验 · OSV.dev

#advisory#cwe-88
安全公告2026-10-01 发布INFO

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

CVE-2026-92957

## Summary NodeVM normalizes `node:`-prefixed builtin specifiers during `require()` resolution, but it does not normali

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-269#cwe-284#severity:critical
安全公告2026-10-01 发布INFO

vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

CVE-2026-92949

### Summary Untrusted JavaScript running inside `new VM().run()` / `new NodeVM().run()` can bypass `vm.freeze()` / `vm.r

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-471#cwe-693#severity:medium
安全公告2026-10-01 发布INFO

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

CVE-2026-92935

## Summary The `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' && requireOp

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-913#severity:critical
安全公告2026-10-01 发布INFO

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

CVE-2026-92937

## Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js pr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-94#cwe-693#severity:critical
安全公告2026-10-01 发布INFO

vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

CVE-2026-92938

### Summary vm2 3.11.6 exposes Node.js's host `node:sqlite` module to `NodeVM` code when that builtin is allowed explic

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-693#severity:critical
安全公告2026-10-01 发布INFO

vm2 crypto builtin loads attacker native code through setEngine

CVE-2026-92939

Summary vm2 3.11.6 exposes the host `crypto` module to a `NodeVM` when that single builtin is allowed. The module is pr

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-114#severity:critical
安全公告2026-10-01 发布INFO

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

CVE-2026-92944

## Reporter - Name or handle: `[YMsora]` - Report date: 2026-08-14 ## Summary The latest published vm2 release, **3.1

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-693#cwe-913#severity:critical
安全公告2026-10-01 发布INFO

vm2 NodeVM can replace the host process TLS trust store

CVE-2026-92941

Summary vm2 3.11.6 exposes the host `tls` module to a `NodeVM` when that builtin is explicitly allowed. Although the mo

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-732#severity:critical
安全公告2026-10-01 发布INFO

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

CVE-2026-92945

## Summary `isPathAllowedForModule` decides whether a resolved path belongs to an allowlisted external module using a r

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#npm#cwe-22#cwe-863#severity:medium
安全公告2026-10-01 发布INFO

JupyterLab: Cross-site scripting (XSS) in JupyterLab via crafted language package (jupyterlab.json)

CVE-2026-102830

## Description A language pack ships a `Plural-Forms` header saying how the language counts, for example `nplurals=2; p

历史摘要 · 未重新核验 · GitHub Advisory

#advisory#pip#cwe-79#cwe-94#cwe-625#severity:medium