All CVEs — page 587 of 631
The complete archive, 25 per page, newest first. 15775 records. Search instead.
The flaw allows sandboxed code to bypass module restrictions by using negative entries in the denylist, granting access to restricted APIs such as fs/promises despite being denied.
The flaw allows sandboxed code to bypass the built-in deny-list by using `node:`-prefixed specifiers, gaining access to potentially dangerous APIs like `child_process`, which can lead to command execution.
This flaw allows sandbox escape via WebAssembly, enabling access to host Node.js capabilities within a sandboxed environment. It is critical due to the potential for full host system compromise.
This vulnerability allows attackers to escape the sandbox and execute arbitrary code with process context, bypassing security restrictions.
The flaw allows code running in the sandbox to ignore rejected Promises from the host realm, potentially leading to unhandled rejections and process termination in Node.js.
This flaw allows attackers to modify host TypedArray and ArrayBuffer prototypes, leading to potential host-created typed arrays observing attacker-controlled properties. This can compromise data integrity and security.
This flaw allows attackers to bypass the allowlist check in vm2 by using a colliding package name, leading to the execution of unauthorized host packages.
This vulnerability allows attackers to execute arbitrary code in the host Node.js process by supplying a malicious script file to the vm2 CLI, bypassing sandbox isolation and accessing host modules like fs and child_process.
The flaw allows a sandbox escape by bypassing vm2's allowlist, permitting execution of arbitrary JavaScript in a Node.js environment.
This flaw allows sandboxed code to access Node's shared Buffer pool, leading to potential data exposure and denial-of-service conditions.
The vulnerability allows remote code execution when require.external is enabled without an explicit require.root that excludes node_modules, posing a critical risk.
This vulnerability allows attackers to bypass sandbox protections in vm2 versions 3.10.2 through 3.11.6 by exploiting the Promise.prototype.finally() method, leading to arbitrary code execution.
This flaw allows attackers to replace the process-wide certificate authorities in NodeVM sandbox code, enabling them to accept attacker-controlled certificates. This can lead to unauthorized access to secure communications.
This flaw allows sandboxed code to access and manipulate host HTTPS requests, enabling credential theft and unauthorized request issuance.
This flaw allows sandboxed JavaScript to escape the NodeVM sandbox by calling the crypto.setEngine() method with a filesystem path to an attacker-supplied native library, leading to arbitrary code execution.
This flaw allows sandboxed code to execute arbitrary native code outside the sandbox with host process privileges by leveraging the Node.js sqlite module.
The flaw allows untrusted code in the sandbox to obtain a fully functional proxy to a host object, enabling arbitrary command execution with host process privileges.
The flaw allows an attacker to escape the sandbox by supplying a specific configuration to the NodeVM constructor, thereby executing arbitrary commands with the host process's privileges.
This flaw allows attackers to bypass sandbox restrictions and execute arbitrary code, posing a critical risk to system security.