https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 13:53:29 +0000 https://vulnerability.circl.lu/vuln/bdu:2026-15025 bdu:2026-15025 https://vulnerability.circl.lu/vuln/bdu:2026-15025 https://vulnerability.circl.lu/vuln/fkie_cve-2026-92959 <p>vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws &#39;Async not available&#39;, the sandbox&#39;s Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code&#39;s then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.</p> <p>vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws &#39;Async not available&#39;, the sandbox&#39;s Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code&#39;s then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-92959 https://vulnerability.circl.lu/vuln/ghsa-9538-79j2-h62h <p>vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws &#39;Async not available&#39;, the sandbox&#39;s Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code&#39;s then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.</p> <p>vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler that throws &#39;Async not available&#39;, the sandbox&#39;s Promise static methods (Promise.resolve, Promise.all, Promise.race, Promise.any, and Promise.allSettled) still assimilate attacker-supplied thenables: native promise resolution performs PromiseResolveThenableJob and invokes the sandboxed code&#39;s then method in a microtask without passing through the patched then, so the async restriction is never applied. As a result, sandboxed script can schedule work that runs after VM.run() or NodeVM.run() has returned and outside the configured timeout, continuing to execute after the host believes execution is complete.</p> https://vulnerability.circl.lu/vuln/ghsa-9538-79j2-h62h https://vulnerability.circl.lu/vuln/rhsa-2026:72712 <p>multer: Multer: Denial of Service via aborted or malformed multipart uploads undici: undici: Denial of Service via unrequested WebSocket subprotocol vm2: vm2: Denial of Service due to memory allocation limit bypass urllib: urllib: Credential leakage via cross-origin redirects js-yaml: js-yaml: Denial of Service via crafted YAML documents immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations qs: qs: Denial of Service via improper validation in stringify function js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing compression: compression: Denial of Service via memory leak on premature response close multer: multer: Denial of Service via orphaned disk writes on aborted uploads isomorphic-git: isomorphic-git: Information disclosure via prototype pollution in getRemoteInfo function. adm-zip: adm-zip: Denial of Service via crafted ZIP archives with zero declared uncompressed size vm2: vm2: Denial of Service via timeout bypass in sandboxed code vm2: vm2: Sandbox escape via denylist bypass in NodeVM vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation vm2: vm2: Denial of Service via memory exhaustion</p> <p>multer: Multer: Denial of Service via aborted or malformed multipart uploads undici: undici: Denial of Service via unrequested WebSocket subprotocol vm2: vm2: Denial of Service due to memory allocation limit bypass urllib: urllib: Credential leakage via cross-origin redirects js-yaml: js-yaml: Denial of Service via crafted YAML documents immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations qs: qs: Denial of Service via improper validation in stringify function js-yaml: js-yaml: Denial of Service vulnerability in YAML parsing compression: compression: Denial of Service via memory leak on premature response close multer: multer: Denial of Service via orphaned disk writes on aborted uploads isomorphic-git: isomorphic-git: Information disclosure via prototype pollution in getRemoteInfo function. adm-zip: adm-zip: Denial of Service via crafted ZIP archives with zero declared uncompressed size vm2: vm2: Denial of Service via timeout bypass in sandboxed code vm2: vm2: Sandbox escape via denylist bypass in NodeVM vm2: vm2: Asynchronous code execution bypass via Promise thenable assimilation vm2: vm2: Denial of Service via memory exhaustion</p> https://vulnerability.circl.lu/vuln/rhsa-2026:72712