Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

3 records

Release: patriksimek vm2 3.12.2 Clear all filters
TI-2026-64879 CVE-2026-100723 · GHSA-43rv-jrfh-9mrr · GHSA-489w-w794-jq94

vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

Priority MEDIUM 64

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00392 Published 2026-09-27 Fixed in 3.12.2 CWE-200
TI-2026-64878 CVE-2026-100722 · GHSA-2v2p-6j97-cjg9 · GHSA-7rr2-8fr3-fjqx

vm2 before 3.12.2 Host Process Termination via Construct Trap

Priority HIGH 72

vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00315 Published 2026-09-27 Partial fix · 3.12.2 CWE-248
TI-2026-64877 CVE-2026-100721 · GHSA-5h3f-q97h-ccvc · GHSA-c9wr-qm7p-p6vc

vm2 before 3.12.2 Authorization Bypass via Custom Resolver

Priority HIGH 76

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00591 Published 2026-09-27 Fixed in 3.12.2 CWE-863