Skip to content
Threat Feed
Subscribe

Tag

Sandbox

3 briefs RSS
critical advisory

Critical Sandbox Escape in vm2 via Node.js Buffer Pool

A vulnerability in the vm2 library (CVE-2026-92947) allows sandboxed code to bypass security boundaries by reading and writing to the host-realm memory shared through Node.js Buffer pools.

vm2 +1 sandbox-escape nodejs vulnerability privilege-escalation denial-of-service sandbox javascript cve-2026-100722
2t 1c
high threat

npm PraisonAI SandboxExecutor Network Isolation Bypass Vulnerability (GHSA-gqmf-56h7-rrpf)

The npm package `praisonai` versions 1.2.3 through 1.7.1 contain a network isolation bypass vulnerability (GHSA-gqmf-56h7-rrpf) in its `SandboxExecutor` component's `network-isolated` mode, allowing non-proxy-aware client commands to establish direct network connections, leading to potential data exfiltration and access to internal services.

praisonai vulnerability npm sandbox network-bypass ghsa
2r 3t
high advisory

OpenClaw Sandbox Browser CDP Relay Vulnerability Exposing DevTools Protocol

OpenClaw versions prior to 2026.4.10 are vulnerable to a configuration issue where the sandbox browser CDP relay could bind too broadly, exposing Chrome DevTools Protocol access outside the intended local/sandbox source range, potentially allowing unauthorized access to browser DevTools.

openclaw cdp devtools sandbox exposure
2r 2t