https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 20:18:44 +0000 https://vulnerability.circl.lu/vuln/cve-2026-44005 <p><strong>Affected:</strong> patriksimek vm2, Red Hat Ansible Automation Platform 2.1, Red Hat Developer Hub</p> <p>vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2&#39;s bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.</p> <p><strong>Affected:</strong> patriksimek vm2, Red Hat Ansible Automation Platform 2.1, Red Hat Developer Hub</p> <p>vm2 is an open source vm/sandbox for Node.js. From 3.9.6 to 3.10.5, vm2&#39;s bridge exposes mutable proxies for real host-realm intrinsic prototypes and then forwards sandbox writes into the underlying host objects with otherReflectSet() and otherReflectDefineProperty(), which lets attacker-controlled JavaScript running in a default VM or inherited NodeVM mutate shared host Object.prototype, Array.prototype, and Function.prototype from inside the sandbox This vulnerability is fixed in 3.11.0.</p> https://vulnerability.circl.lu/vuln/cve-2026-44005