Security: patriksimek/vm2
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
NodeVM observability builtins leak host process and HTTP request dataGHSA-9g8x-92q2-p28f published
May 18, 2026 by patriksimekModerate -
NodeVM network builtin exclusions bypass via internal _http_client and _http_serverGHSA-r9pm-gxmw-wv6p published
May 18, 2026 by patriksimekHigh -
NodeVM builtin denylist bypass via process and inspector/promises allows host code executionGHSA-rp36-8xq3-r6c4 published
May 18, 2026 by patriksimekCritical -
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypassGHSA-6j2x-vhqr-qr7q published
May 18, 2026 by patriksimekCritical -
GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCEGHSA-m4wx-m65x-ghrr published
May 18, 2026 by patriksimekCritical -
Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chainGHSA-c4cf-2hgv-2qv6 published
May 18, 2026 by patriksimekHigh -
Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checksGHSA-m5q2-4fm3-vfqp published
May 18, 2026 by patriksimekHigh -
Sandbox Breakout Using Promise SpeciesGHSA-76w7-j9cq-rx2j published
May 18, 2026 by patriksimekCritical -
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatterGHSA-q3fm-4wcw-g57x published
May 18, 2026 by patriksimekLow -
Sandbox EscapeGHSA-v6mx-mf47-r5wg published
May 18, 2026 by patriksimekCritical