vm2 vulnerabilities (npm)
78 vulnerabilities.
-
vm2npm vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool 6.9 Medium -
vm2npm vm2 before 3.12.2 Host Process Termination via Construct Trap 8.9 High -
vm2npm vm2 before 3.12.2 Authorization Bypass via Custom Resolver 9.5 Critical -
vm2npm vm2 NodeVM before 3.12.1 Remote Code Execution via child_process 10.0 Critical -
vm2npm vm2 before 3.11.8 allowAsync Bypass via Promise Thenable 7.1 High -
vm2npm vm2 before 3.11.7 Denylist Bypass via fs/promises 8.4 High -
vm2npm vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix 9.4 Critical -
vm2npm vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming 10.0 Critical -
vm2npm vm2 before 3.11.8 Sandbox Escape via NodeVM 10.0 Critical -
vm2npm vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise 9.2 Critical -
vm2npm vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray 9.3 Critical -
vm2npm vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass 8.9 High -
vm2npm vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver 9.4 Critical -
vm2npm vm2 before 3.11.7 Sandbox Escape via CLI require 9.3 Critical -
vm2npm vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor 6.3 Medium -
vm2npm vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test 9.4 Critical -
vm2npm vm2 before 3.11.7 Memory Disclosure via Buffer Pool 10.0 Critical -
vm2npm vm2 before 3.11.7 Remote Code Execution via require.external 10.0 Critical -
vm2npm vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching 2.3 Low -
vm2npm vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector 9.3 Critical -
vm2npm vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry 8.7 High -
vm2npm vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation 10.0 Critical -
vm2npm vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent 10.0 Critical -
vm2npm vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine 9.4 Critical -
vm2npm vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite 9.4 Critical -
vm2npm vm2 3.11.6 Remote Code Execution via Promise call/apply 10.0 Critical -
vm2npm vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack 6.9 Medium -
vm2npm vm2 NodeVM Remote Code Execution via Array-Shaped Require 9.5 Critical -
vm2npm vm2 before 3.11.8 Sandbox Escape RCE via AggregateError 9.5 Critical -
vm2npm vm2 before 3.11.8 Information Disclosure via util.getCallSites 6.9 Medium -
vm2npm vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass 8.7 High -
vm2npm vm2 before 3.11.6 Process-wide State Exposure via os and dns 10.0 Critical -
vm2npm vm2: Sandbox Breakout Using Dangerous Host Proto Mutators 9.8 Critical -
vm2npm vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE 9.9 Critical -
vm2npm vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike 8.7 High -
vm2npm vm2: NodeVM observability builtins leak host process and HTTP request data 6.9 Medium -
vm2npm vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server 8.6 High -
vm2npm vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution 10.0 Critical -
vm2npm vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass 9.8 Critical -
vm2npm vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE 10.0 Critical -
vm2npm vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain 8.6 High -
vm2npm vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks 8.7 High -
vm2npm vm2: Sandbox Breakout Using Promise Species 10.0 Critical -
vm2npm vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js 2.1 Low -
vm2npm vm2: Sandbox Escape 10.0 Critical -
vm2npm vm2: Sandbox Breakout Using Async Generator 9.8 Critical -
vm2npm vm2 before 3.11.2 Information Disclosure via Internal State 6.9 Medium -
vm2npm vm2: Sandbox Breakout Through Null Proto Exception 9.8 Critical -
vm2npm vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` 9.8 Critical -
vm2npm vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution 9.1 Critical - Show olderLoading…