Mmastodon TechnologyCybersecurity first seen 4 h ago, last 4 h ago, peak #9

Low-severity vm2 sandbox flaw disclosed under EUVD-2026-81594

Original: 🚨 EUVD-2026-81594 📊 Score: 2.3/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: External

A new vulnerability entry, EUVD-2026-81594, has been published for the vm2 JavaScript sandbox library maintained by patriksimek. The flaw carries a low CVSS v3.1 score of 2.3 out of 10 and stems from the external module allowlist using a raw prefix test, meaning a sibling package sharing a name prefix is incorrectly treated as allowlisted. The entry was updated on 1 October 2026.

Why now: New security advisory entries are routinely shared and discussed in cybersecurity communities when published, even for low-severity issues.

vm2patriksimekENISA

Open on mastodon →

Evidence

• 🚨 EUVD-2026-81594 📊 Score: 2.3/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted 🔗 https:// euvd.enisa.europa.eu/vulnerabi… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/627924