SB2026081509 - Multiple vulnerabilities in vm2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026081509

SB2026081509 - Multiple vulnerabilities in vm2

Published: August 15, 2026

Security Bulletin ID SB2026081509
CSH Severity
High
Patch available
YES
Number of vulnerabilities 5
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 40% Medium 60%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 5 vulnerabilities.


1) Improper Authorization (CVE-ID: N/A)

CWE-ID: CWE-285 - Improper Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive information and modify host process state.

The vulnerability exists due to improper authorization in NodeVM builtin module handling when expanding the `builtin: [\'*\']` allowlist and exposing the `os` and `dns` modules. A remote attacker can execute sandboxed code that invokes `os` and `dns` APIs to disclose sensitive information and modify host process state.

The issue is exploitable in configurations that allow full builtins through the wildcard pattern without excluding `os` and `dns`.


2) Improper Control of Dynamically-Managed Code Resources (CVE-ID: CVE-2026-47698)

CWE-ID: CWE-913 - Improper Control of Dynamically-Managed Code Resources

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary commands on the host system.

The vulnerability exists due to improper control of dynamically-managed code resources in the vm2 sandbox when handling indirect calls to dangerous host proto mutators. A remote attacker can run crafted code inside a vm2 sandbox to execute arbitrary commands on the host system.

Exploitation requires the ability to run arbitrary code within the context of a vm2 sandbox.


3) Protection mechanism failure (CVE-ID: CVE-2026-47686)

CWE-ID: CWE-693 - Protection Mechanism Failure

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code on the host system.

The vulnerability exists due to protection mechanism failure in the handleException function in lib/setup-sandbox.js when handling host-thrown errors with an unsanitized Error.cause property. A remote user can access a host object reference through the error cause and invoke host functionality to execute arbitrary code on the host system.

Exploitation requires that an embedder-exposed function throws an Error whose cause references a powerful host object.


4) Allocation of Resources Without Limits or Throttling (CVE-ID: N/A)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in the bufferAllocLimit defense in setup-sandbox.js when processing sandboxed code that invokes ArrayBuffer, SharedArrayBuffer, or TypedArray constructors. A remote attacker can execute crafted code in the sandbox to cause a denial of service.

A single large allocation can exhaust host memory through the underlying V8 and libuv allocation path, and the condition affects configurations that rely on bufferAllocLimit for memory allocation restrictions.


5) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-47683)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to allocation of resources without limits or throttling in Buffer.concat and Buffer.from array-like handling when processing sandbox-supplied Buffer allocation requests. A remote attacker can send crafted sandbox code to trigger large host Buffer allocations and cause a denial of service.

The issue affects host external-memory allocation paths that bypass the configured buffer allocation cap, and the synchronous allocation cannot be preempted by the timeout mechanism.


Remediation

Install update from vendor's website.

References