rootpwn

critical · CVSS v3 10 · CVSS v4 10

CVE-2026-93605

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits chi…

Description

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules. Attackers can require child_process and execute arbitrary commands on the host system when NodeVM is configured with builtin:['*'] or explicit child_process allowance.

Scores

Severity
critical
CVSS v2
10
CVSS v3
10
CVSS v4
10
EPSS
—

← All CVEs

Related CVEs

critical

CVE-2026-93564

HAProxy PROXY-v2 nested-TLV grandchild ByteBuf reference-count leak allows memory exhaustion. The flaw resides in the handling of nested TLVs in the PROXY protocol. It can lead to denial of service on affected HAProxy instances.

View analysis

critical

CVE-2026-93565

CVE-2026-93565 allows an attacker to send RTSP requests with trailing control bytes that are silently stripped by RtspMethods.valueOf(), causing the server to treat them as valid method tokens. This flaw exists in Netty-based RTSP servers and can lead to unauthorized or malformed requests being accepted as legitimate. The vulnerability is critical with a CVSS v3 score of 9.8.

View analysis

critical

CVE-2026-93567

HTTP/1 authority-form CONNECT is translated to malformed HTTP/2 CONNECT with Host-controlled :authority

View analysis

critical

CVE-2026-93569

HTTP/1 absolute-form Host mismatch is translated to HTTP/2 :authority, overriding the request-target authority

View analysis