https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 01:15:02 +0000 https://vulnerability.circl.lu/vuln/cve-2026-92933 <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 is a sandbox for running untrusted Node.js code. In versions &lt;= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js &gt;= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process&#39;s full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application&#39;s entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.</p> <p><strong>Affected:</strong> patriksimek vm2</p> <p>vm2 is a sandbox for running untrusted Node.js code. In versions &lt;= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js &gt;= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process&#39;s full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application&#39;s entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.</p> https://vulnerability.circl.lu/vuln/cve-2026-92933