Red Hat Security Advisory

RHSA-2026:50850

Red Hat Ansible Automation Platform 2.1 security update

Released 2026-08-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.1 registry.redhat.io/ansible-automation-platform/automation-portal

Fixes 25 records

TI-2026-34731 CVE-2026-47140 · GHSA-rp36-8xq3-r6c4

vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00978 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-34728 CVE-2026-47137 · GHSA-m4wx-m65x-ghrr

vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00382 Published 2026-06-12 Fixed in 3.11.4 CWE-913

TI-2026-34722 CVE-2026-47131 · GHSA-v6mx-mf47-r5wg

vm2: Sandbox Escape

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00757 Published 2026-06-12 Fixed in 3.11.4 CWE-913

TI-2026-33200 CVE-2026-45411 · GHSA-248r-7h7q-cr24

vm2: Sandbox Breakout Using Async Generator

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00568 Published 2026-05-13 Fixed in 3.11.3 CWE-668

TI-2026-32052 CVE-2026-44009 · GHSA-9vg3-4rfj-wgcm

vm2: Sandbox Breakout Through Null Proto Exception

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01015 Published 2026-05-13 Fixed in 3.11.2 CWE-668

TI-2026-32051 CVE-2026-44008 · GHSA-9qj6-qjgg-37qq

vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00892 Published 2026-05-13 Fixed in 3.11.2 CWE-668

TI-2026-32049 CVE-2026-44006 · GHSA-qcp4-v2jj-fjx8

vm2: Sandbox Escape

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00815 Published 2026-05-13 Fixed in 3.11.0 CWE-94

TI-2026-32048 CVE-2026-44005 · GHSA-vwrp-x96c-mhwq

vm2: Sandbox escape

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00831 Published 2026-05-13 Fixed in 3.11.0 CWE-1321

TI-2026-32040 CVE-2026-43997 · GHSA-47x8-96vw-5wg6

vm2: Sandbox Escape

HIGH 82

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00976 Published 2026-05-13 Fixed in 3.11.0 CWE-94

TI-2026-36071 CVE-2026-48801 · GHSA-22p9-wv53-3rq4

linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

HIGH 77

linkify-it is a links recognition library with full Unicode support.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00394 Published 2026-07-14 Partial fix · 5.0.1 CWE-1333

TI-2026-34797 CVE-2026-47209 · GHSA-c4cf-2hgv-2qv6

vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

HIGH 76

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00287 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-34730 CVE-2026-47139 · GHSA-r9pm-gxmw-wv6p

vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

HIGH 76

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00359 Published 2026-06-12 Fixed in 3.11.4 CWE-693

TI-2026-32044 CVE-2026-44001 · GHSA-hw58-p9xv-2mjh

vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

HIGH 76

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00448 Published 2026-05-13 Fixed in 3.11.0 CWE-248

TI-2026-32042 CVE-2026-43999 · GHSA-947f-4v7f-x2v8

vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape

HIGH 76

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00974 Published 2026-05-13 Fixed in 3.11.0 CWE-863

TI-2026-32050 CVE-2026-44007 · GHSA-8hg8-63c5-gwmx

vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution

HIGH 74

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.01005 Published 2026-05-13 Fixed in 3.11.1 CWE-284

TI-2026-32047 CVE-2026-44004 · GHSA-6785-pvv7-mvg7

vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)

HIGH 72

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00419 Published 2026-05-13 Fixed in 3.11.0 CWE-770

TI-2026-32041 CVE-2026-43998 · GHSA-cp6g-6699-wx9c

vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape

HIGH 72

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00722 Published 2026-05-13 Fixed in 3.11.0 CWE-59

TI-2026-32043 CVE-2026-44000 · GHSA-mpf8-4hx2-7cjg

vm2: sandbox boundary bypass via host Promise resolution preserving host object identity

HIGH 71

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.002 Published 2026-05-13 Fixed in 3.11.0 CWE-693

TI-2026-34732 CVE-2026-47141 · GHSA-9g8x-92q2-p28f

vm2: NodeVM observability builtins leak host process and HTTP request data

HIGH 70

vm2 is an open source vm/sandbox for Node.js.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00383 Published 2026-06-12 Fixed in 3.11.4 CWE-668

TI-2026-32046 CVE-2026-44003 · GHSA-wp5r-2gw5-m7q7

vm2: Transformer Fast-Path Bypass Exposes Internal State Variable

HIGH 65

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00248 Published 2026-05-13 Fixed in 3.11.0 CWE-693

TI-2026-32045 CVE-2026-44002 · GHSA-v27g-jcqj-v8rw

vm2: Host File Path Disclosure via Stack Trace Information Leak

HIGH 65

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1MEDIUM 5.8 Network No auth No interaction EPSS 0.00241 Published 2026-05-13 Fixed in 3.11.0 CWE-209

TI-2026-08149 CVE-2026-9277 · GHSA-w7jw-789q-3m8p

shell-quote `quote()` does not validate object-token shapes, allowing command injection via line terminators in `.op`

MEDIUM 43

shell-quote's `quote()` function did not validate object-token inputs against the operator model used by `parse()`.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00793 Published 2026-05-22 Partial fix · 1.8.4 CWE-77

TI-2026-35509 CVE-2026-48068 · GHSA-5375-pq7m-f5r2

@grpc/grps-js: A malformed request can cause a server crash

MEDIUM 41

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00882 Published 2026-07-14 Partial fix · 1.9.16, 1.11.4 +4 CWE-248

TI-2026-42691 CVE-2026-59877 · GHSA-j3f2-48v5-ccww

protobufjs: Denial of Service via infinite loop in .proto option parsing

LOW 39

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00365 Published 2026-07-08 Partial fix · 7.6.5, 8.6.6 CWE-835

TI-2026-34726 CVE-2026-47135 · GHSA-m5q2-4fm3-vfqp

vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

LOW 39

vm2 is an open source vm/sandbox for Node.js.

CVSS 3.1HIGH 8.7 Network No auth No interaction EPSS 0.00266 Published 2026-06-12 Fixed in 3.11.4 CWE-693