{
 "version": "https://jsonfeed.org/version/1.1",
 "title": "patriksimek vm2: all CVE events",
 "home_page_url": "https://patchwire.jonathanross.dev/products/patriksimek--vm2/",
 "feed_url": "https://patchwire.jonathanross.dev/feeds/products/patriksimek--vm2/all.json",
 "authors": [
  {
   "name": "Patchwire"
  }
 ],
 "language": "en",
 "items": [
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100723/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100723/",
   "title": "CVE-2026-100723 · patriksimek vm2 · disclosed",
   "content_text": "vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.",
   "date_published": "2026-09-27T01:28:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100723/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100723/",
   "title": "CVE-2026-100723 · patriksimek vm2 · fixed upstream (npm)",
   "content_text": "Fixed versions: vm2 3.12.2.",
   "date_published": "2026-09-27T01:28:30Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100722/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100722/",
   "title": "CVE-2026-100722 · patriksimek vm2 · disclosed",
   "content_text": "vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.",
   "date_published": "2026-09-27T01:28:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100722/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100722/",
   "title": "CVE-2026-100722 · patriksimek vm2 · fixed upstream (npm)",
   "content_text": "Fixed versions: vm2 3.12.2.",
   "date_published": "2026-09-27T01:28:29Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100721/disclosed",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100721/",
   "title": "CVE-2026-100721 · patriksimek vm2 · disclosed",
   "content_text": "vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.",
   "date_published": "2026-09-27T01:28:28Z"
  },
  {
   "id": "tag:patchwire.jonathanross.dev,2026:CVE-2026-100721/fixed/npm",
   "url": "https://patchwire.jonathanross.dev/cve/CVE-2026-100721/",
   "title": "CVE-2026-100721 · patriksimek vm2 · fixed upstream (npm)",
   "content_text": "Fixed versions: vm2 3.12.2.",
   "date_published": "2026-09-27T01:28:28Z"
  }
 ]
}