vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks

CVE-2026-92952

## Summary vm2 current head (`v3.11.5`, commit `7a1f5100b96f48d34e0fe104ab37c0acc5944f92`) still exposes registered Nod

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

CVE-2026-92948

## Summary On Node.js 24 and newer, `vm2` can expose the host `node:test` module to sandboxed `NodeVM` code when the em

历史摘要 · 未重新核验 · GitHub Advisory

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

CVE-2026-92950

### Summary The `vm2` command-line tool installed by `npm install -g vm2` and documented in the README's "CLI" section r

历史摘要 · 未重新核验 · GitHub Advisory

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

CVE-2026-92940

Summary vm2 3.11.6 exposes the host process's real `https.globalAgent` when a `NodeVM` is explicitly allowed to require

历史摘要 · 未重新核验 · GitHub Advisory

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

CVE-2026-92951

### Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

CVE-2026-92958

## Summary NodeVM's builtin wildcard policy can allow sandboxed code to access `fs/promises` even when the embedder den

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

CVE-2026-92957

## Summary NodeVM normalizes `node:`-prefixed builtin specifiers during `require()` resolution, but it does not normali

历史摘要 · 未重新核验 · GitHub Advisory

vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor

CVE-2026-92949

### Summary Untrusted JavaScript running inside `new VM().run()` / `new NodeVM().run()` can bypass `vm.freeze()` / `vm.r

历史摘要 · 未重新核验 · GitHub Advisory

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

CVE-2026-92935

## Summary The `NodeVM` constructor computes `hasRealRequireConfig` using `typeof requireOpts === 'object' && requireOp

历史摘要 · 未重新核验 · GitHub Advisory

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection

CVE-2026-92937

## Summary Untrusted JavaScript run by vm2 can escape the sandbox and execute arbitrary commands in the host Node.js pr

历史摘要 · 未重新核验 · GitHub Advisory

vm2 allows a sandboxed plugin to execute native code through `node:sqlite`

CVE-2026-92938

### Summary vm2 3.11.6 exposes Node.js's host `node:sqlite` module to `NodeVM` code when that builtin is allowed explic

历史摘要 · 未重新核验 · GitHub Advisory

vm2 crypto builtin loads attacker native code through setEngine

CVE-2026-92939

Summary vm2 3.11.6 exposes the host `crypto` module to a `NodeVM` when that single builtin is allowed. The module is pr

历史摘要 · 未重新核验 · GitHub Advisory

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector

CVE-2026-92944

## Reporter - Name or handle: `[YMsora]` - Report date: 2026-08-14 ## Summary The latest published vm2 release, **3.1

历史摘要 · 未重新核验 · GitHub Advisory

vm2 NodeVM can replace the host process TLS trust store

CVE-2026-92941

Summary vm2 3.11.6 exposes the host `tls` module to a `NodeVM` when that builtin is explicitly allowed. Although the mo

历史摘要 · 未重新核验 · GitHub Advisory

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

CVE-2026-92945

## Summary `isPathAllowedForModule` decides whether a resolved path belongs to an allowlisted external module using a r

历史摘要 · 未重新核验 · GitHub Advisory

devalue: `stringify`/`uneval` serialize shared memory

CVE-2026-92708

### Impact `stringify` and `uneval` serialize a typed array by emitting its backing `ArrayBuffer`, not just the view. I

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Residual sparse-array CPU amplification in uneval

`uneval` performs synchronous work proportional to a sparse array's declared length. An application that passes attacker

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Repeated primitive strings cause quadratic expansion in uneval

Under very constrained circumstances, data that was `parse`d and then passed to `uneval` could turn a small payload into

历史摘要 · 未重新核验 · GitHub Advisory

devalue: Sparse arrays emitted by uneval cause eager allocation when evaluated

Evaluating legitimate `uneval` output for a sparse array can allocate memory proportional to its declared length. A tiny

历史摘要 · 未重新核验 · GitHub Advisory

devalue: stringifyAsync can cause an unhandled rejection despite a caught returned promise

When serializing multiple promises, a later promise can reject before an earlier one settles. An internal rejected promi

历史摘要 · 未重新核验 · GitHub Advisory