The vm2 library has multiple critical vulnerabilities that allow sandbox escape and remote code execution, posing a significant risk to system security.

🚨 EUVD-2026-81601 📊 Score: 8.9/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81601 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81597 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81597 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81599 📊 Score: 9.3/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81599 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81590 📊 Score: 10.0/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 exposes host HTTPS credentials and TLS traffic through globalAgent 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81590 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81600 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81600 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81607 📊 Score: 8.4/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81607 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81598 📊 Score: 6.3/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81598 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81585 📊 Score: 9.5/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81585 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81587 📊 Score: 10.0/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81587 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81588 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 allows a sandboxed plugin to execute native code through `node:sqlite` 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81588 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81589 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 crypto builtin loads attacker native code through setEngine 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81589 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81593 📊 Score: 9.3/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81593 #cybersecurity #infosec #euvd #cve #vulnerability

🚨 EUVD-2026-81591 📊 Score: 10.0/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 NodeVM can replace the host process TLS trust store 🔗 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81591 #cybersecurity #infosec #euvd #cve #vulnerability