Mmastodon TechnologyCybersecurity first seen 5 h ago, last 5 h ago, peak #12

Critical 9.4-severity vulnerability disclosed in vm2 sandbox library

Original: 🚨 EUVD-2026-81589 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 crypto bu

A high-severity vulnerability, EUVD-2026-81589, has been catalogued in vm2, the JavaScript sandbox library maintained by Patrik Simek. Scored 9.4 out of 10 under CVSS v3.1, the flaw involves vm2's crypto builtin loading attacker-supplied native code through the setEngine function, a path that could allow sandbox escapes or arbitrary code execution. The advisory was updated on October 1, 2026, and security teams are being urged to review any systems relying on vm2 for isolating untrusted JavaScript.

Why now: Security professionals are tracking a newly updated critical vulnerability in a widely used JavaScript sandboxing library.

vm2Patrik SimekENISAEUVD-2026-81589

Open on mastodon →

Evidence

• 🚨 EUVD-2026-81589 📊 Score: 9.4/10 (CVSS v3.1) 📦 Product: vm2 🏢 Vendor: patriksimek 📅 Updated: 2026-10-01 📝 vm2 crypto builtin loads attacker native code through setEngine 🔗 https:// euvd.enisa.europa.eu/vulnerabi lity/EUVD-2026-81589 # cybersecurity # infosec # euvd # cve #… · EUVD_Bot

API: https://socialmediatrends-api.osmike.com/v1/trends/627927