Alertas de Seguridad de la Información

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92956] vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sand…

vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26. WebAssembly.compileStreaming and WebAssembly.instantiateStreaming can produce a raw host-realm Promise that rejects with a host-realm error object; by controlling Symbol.species via Promise.prototype.finally, sandbox code receives that raw host error, walks from the h…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92957] vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-suppl…

vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy. Although NodeVM strips the `node:` prefix during require() resolution, negative wildcard entries are matched by exact string comparison against the canonical builtin names, so a policy such as `new NodeVM({ require: { builtin: ['*', '-…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92947] vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host m…

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92948] vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a…

vm2 versions >= 3.9.6 and

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92951] vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlis…

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92940] vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed cod…

vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('https'). The builtin loader wraps host modules in a read-only proxy, but method calls such as Agent.prototype.on() are forwarded to the underlying host object, so sandbox code can register a listener for the agent's 'free' event. When an unr…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92941] vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing a…

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-co…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92944] vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promis…

vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections due to a stale PromiseThenLookupChain protector in V8 14.6. Attackers can exploit this by creating an async function that returns a Promise with an attacker-controlled constructor Symbol.species, allowing them to reach the host Function constr…

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92946] vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled wi…

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92937] vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js pr…

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is incomplete: the bridge gate at lib/bridge.js:1624 identity-checks only the direct call target when deciding whether to rebuild/sanitise a rejected host Promise value. Registering the rejection handler through Function.prototype.call or .apply indirection (e.…

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92938] vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeV…

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with 'node:' as a core-module request and t…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92939] vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto…

vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via a recursive read-only proxy, but its callable exports still execute with host-process authority. Sandboxed JavaScript can therefore call crypto.setEngine() with a filesystem path to an attacker-supplied native library (for example, one bundled in an u…

nvdcriticovulnerabilidad CVSS 9.9 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92934] vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape…

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle detection bypass in handleException to access unsanitized host proxies embedded in the errors array, enabling full remote code execution and process information dis…

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-92935] vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM…

vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-62104] Unauthenticated Remote Code Execution (RCE) in Migratico Lite <= 2.6.8 versions.

Unauthenticated Remote Code Execution (RCE) in Migratico Lite

nvdcriticovulnerabilidad CVSS 10.0 NVD

M Crítico vulnerabilidad

17/09/2026

Vulnerabilidad crítica en rcourtman Pulse permite inyección de código remota

Se descubrió una falla de validación de entrada en rcourtman Pulse (versiones hasta 6.0.4 y 6.1.0-rc.4) en el componente Quick Security Setup Handler (/api/security/quick-setup). Un atacante remoto puede manipular el parámetro Username para ejecutar código arbitrario con CVSS 9.1. Afecta principalmente a servidores de autenticación y control de acceso en infraestructuras corporativas de México y LATAM.

nvdcriticovulnerabilidad CVSS 9.1 NVD

M Crítico vulnerabilidad

17/09/2026

Vulnerabilidad crítica de inyección de comandos en appliances FatPipe MPVPN, WARP e IPVPN

Los equipos FatPipe MPVPN, WARP e IPVPN con firmware 10.1.2r60p100 (fin de vida) contienen una vulnerabilidad de inyección de comandos OS en el demonio xtremed. Un atacante remoto no autenticado puede enviar entrada manipulada al endpoint AuthFormServlet para ejecutar comandos arbitrarios en el sistema, afectando la integridad de infraestructuras VPN críticas en empresas latinoamericanas. El CVSS de 9.8 refleja el riesgo extremo sin requerir autenticación previa.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/09/2026

Vulnerabilidad crítica en FatPipe MPVPN, WARP e IPVPN: desbordamiento de búfer remoto (CVE-2026-90823)

Los equipos FatPipe MPVPN, WARP e IPVPN con firmware 10.1.2r60p100 (fin de vida) contienen un desbordamiento de búfer en la interfaz de autenticación que permite ejecución remota de código sin credenciales. Un atacante puede enviar una solicitud manipulada contra la interfaz de gestión para comprometer completamente el dispositivo, poniendo en riesgo la conectividad WAN y acceso a datos corporativos en LATAM.

nvdcriticovulnerabilidad CVSS 9.8 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-88795] The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authenticat…

The wpShopGermany IT-RECHT KANZLEI WordPress plugin before 2.4 does not generate its API authentication token securely, deriving it from data the requester controls and creating it as a side effect of the check that is supposed to validate it, allowing unauthenticated attackers to predict the token and use the access it grants to write arbitrary files, leading to remote code execution.

nvdcriticovulnerabilidad CVSS 9.0 NVD

M Crítico vulnerabilidad

17/09/2026

[CVE-2026-87796] The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in …

The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.1.9 via the move_file function. This is due to insufficient file type validation during chunked upload handling. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution poss…

nvdcriticovulnerabilidad CVSS 9.8 NVD