SB2026110861 - Multiple vulnerabilities in vm2

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026110861

SB2026110861 - Multiple vulnerabilities in vm2

Published: November 8, 2026

Security Bulletin ID SB2026110861
CSH Severity
High
Patch available
YES
Number of vulnerabilities 3
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 3 vulnerabilities.


1) Incorrect authorization (CVE-ID: N/A)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to execute existing host code outside the vm2 NodeVM sandbox.

The vulnerability exists due to missing path-boundary checks when NodeVM authorizes custom-resolved external modules in a configuration using a custom resolver and context: 'host'. An unauthenticated remote attacker can submit guest JavaScript that first requires an allowlisted module and then requires an existing readable sibling file sharing its path prefix, causing the unauthorized file to execute in the host process.


2) Uncaught Exception (CVE-ID: N/A)

CWE-ID: CWE-248 - Uncaught Exception

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to terminate the Node.js process hosting a vm2 sandbox, denying service.

The vulnerability exists due to missing rejection handling in vm2's host-constructor bridge when an application exposes a constructor that returns a rejected native Promise. An unauthenticated remote attacker can submit sandbox JavaScript that invokes this constructor and ignores its result, causing process termination when the host uses strict unhandled-rejection handling.


3) Information disclosure (CVE-ID: N/A)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to read sensitive host memory and corrupt unrelated host buffers across the vm2 sandbox boundary.

The vulnerability exists due to shared backing memory exposed by buffers returned from zlib in NodeVM when the host explicitly allowlists that builtin. An unauthenticated remote attacker can execute guest code that calls zlib.deflateSync and creates a full backing-store view to read and modify bytes outside the compressed result.


Remediation

Install update from vendor's website.

References