npm - OSV

GHSA-pq68-rvw4-xp4r

npm/vm2

vm2 contains a sandbox escape vulnerability 07 Oct

Fix available
Severity - 10.0 (Critical)

GHSA-5h3f-q97h-ccvc

npm/vm2

vm2: NodeVM custom resolution bypasses external path boundaries 05 Oct

Fix available
Severity - 9.5 (Critical)

GHSA-2v2p-6j97-cjg9

npm/vm2

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process 05 Oct

Fix available
Severity - 8.9 (High)

GHSA-489w-w794-jq94

npm/vm2

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary 05 Oct

Fix available
Severity - 6.9 (Medium)

GHSA-f8gf-w286-fmq2

npm/vm2

vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM 05 Oct

Fix available
Severity - 7.1 (High)

GHSA-88hf-g992-jg85

npm/vm2

vm2: Sandbox Escape (NodeVM) 05 Oct

Fix available
Severity - 10.0 (Critical)

GHSA-gjq8-xm47-88rc

npm/vm2

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process 05 Oct

Fix available
Severity - 9.2 (Critical)

GHSA-3vgf-8m4q-q4qr

npm/vm2

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix 05 Oct

Fix available
Severity - 9.3 (Critical)

GHSA-x965-fc75-jpqh

npm/vm2

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit 05 Oct

Fix available
Severity - 9.5 (Critical)

GHSA-r273-hxvj-fxhp

npm/vm2

vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack 05 Oct

Fix available
Severity - 6.9 (Medium)

GHSA-x6m4-chr9-cg97

npm/vm2

vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting 05 Oct

Fix available
Severity - 6.9 (Medium)

GHSA-r4fx-v8hh-22mv

npm/vm2

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block) 05 Oct

Fix available
Severity - 7.5 (High)

GHSA-j3hm-6rg5-mchv

npm/vm2

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE 05 Oct

Fix available
Severity - 10.0 (Critical)

GHSA-fcqc-726x-5wfc

npm/vm2

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool 05 Oct

Fix available
Severity - 10.0 (Critical)

GHSA-wjwh-qqvp-g4p4

npm/vm2

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass 05 Oct

Fix available
Severity - 10.0 (Critical)

GHSA-jf8q-945g-9q4c

npm/vm2

vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks 01 Oct

Fix available
Severity - 6.8 (Medium)

Vulnerabilities