Описание
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.
A flaw was found in vm2 (before 3.11.2). A sandbox escape vulnerability allows remote attackers to execute arbitrary code on the host system by breaking vm2 isolation. Fixed in 3.11.2.
Отчет
vm2 is vulnerable to sandbox escape leading to arbitrary code execution on the host. A remote unauthenticated attacker who can submit code to the vm2 sandbox may escape isolation and execute arbitrary commands. Fixed in vm2 3.11.2.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Developer Hub | rhdh/rhdh-hub-rhel9 | Not affected | ||
| Red Hat Ansible Automation Platform 2.1 | ansible-automation-platform/automation-portal | Fixed | RHSA-2026:50850 | 05.08.2026 |
Показывать по
Дополнительная информация
Статус:
EPSS
9.8 Critical
CVSS3
Связанные уязвимости
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, This vulnerability is fixed in 3.11.2.
vm2 has Sandbox Breakout Through Null Proto Exception
Уязвимость библиотеки vm2 пакетного менеджера NPM, позволяющая нарушителю выполнять произвольные команды
EPSS
9.8 Critical
CVSS3