Monthly
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Sandbox escape in Google Chrome's Linux Toolkit Theming component (prior to 151.0.7922.173) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. This is a two-stage attack: the renderer must be compromised first, then this CWE-913 flaw in the theming subsystem is leveraged to break out of the sandbox entirely, achieving host-level code execution. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.38% (32nd percentile), consistent with an absence of observed mass exploitation.
Privilege escalation in the search-v2-operator (Red Hat Advanced Cluster Management / OpenShift search component) allows a user with edit rights on the Search Custom Resource to abuse unvalidated CR fields (imageOverride, arguments, environment variables) to load an attacker-controlled container image or mount arbitrary secrets. Because the search ServiceAccount holds broad impersonation permissions, controlling that pod pivots into full cluster compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 9.1 rating reflects the scope change from a namespaced CR editor to the entire cluster.
Sandbox escape in the vm2 Node.js sandboxing library (npm, versions <= 3.11.5) lets code running inside the sandbox reach host prototype mutators and execute arbitrary OS commands on the host. It bypasses the earlier GHSA-v6mx-mf47-r5wg fix by stacking Function.prototype.call indirection so the dangerous __proto__ setter is no longer in the inspected position, then leaks a live host reference through a rejected WebAssembly.compileStreaming promise to pivot to child_process. A working proof-of-concept is published in the advisory, so publicly available exploit code exists; the flaw is not listed in CISA KEV.
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke arbitrary Upgrade and filesystem export methods - including OS command execution, file mutation, and process termination - by supplying attacker-controlled function names to the `upgrade-func` and `handleFs` WebSocket handlers. The root cause is the absence of allowlist validation in `src/app/server/dispatch-center.js` and `src/app/server/fs.js`, where client-supplied `func` strings were passed directly to dynamic method calls, including paths exploitable via JavaScript prototype chain traversal. No public exploit or CISA KEV listing exists at time of analysis; CVSS 8.8 reflects the high impact and low complexity once a valid authenticated session is held.
Sandbox escape in vm2 (npm package, versions <= 3.11.3) allows arbitrary code execution in the Node.js host process when untrusted code is run on runtimes exposing WebAssembly JSPI (Node 24 with --experimental-wasm-jspi, or Node 26+ by default). A working PoC demonstrates that a JSPI-backed Promise reaches host-realm Promise.prototype.finally without bridge interposition, letting attacker-controlled species logic walk a rejection object's constructor chain to host process and execute arbitrary commands. No public exploit identified as actively used in the wild, but a complete weaponized PoC is published in the GHSA advisory.
Sandbox escape in vm2 (npm package, versions <= 3.11.3) allows full remote code execution by bypassing the GHSA-8hg8-63c5-gwmx (CVE-2023-37903) patch through omission of the require option when nesting:true is set. Publicly available exploit code exists in the GHSA advisory itself, and with a CVSS of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) any application passing untrusted code to a NodeVM configured this way is trivially compromised on the host.
Remote code execution in the vm2 Node.js sandbox library (versions <= 3.11.3) allows sandboxed JavaScript to escape isolation and execute arbitrary commands on the host. The flaw stems from a missing resetPromiseSpecies call in the localPromise swallow tail, letting a sandbox subclass hijack Promise species resolution and capture a raw host-realm RangeError that exposes the host Function constructor. Publicly available exploit code exists (POC published in the advisory), though no public exploit identified at time of analysis as actively exploited in the wild; given vm2's heavy use as an untrusted-code sandbox in SaaS, CI, and serverless platforms, this is a top-priority issue.
Sandbox escape in the vm2 Node.js sandbox library (versions <= 3.11.3) allows untrusted JavaScript executed inside a vm2 VM to reach the host realm and achieve arbitrary code execution. By chaining Buffer.call.call indirection with __lookupGetter__/__lookupSetter__ to obtain host Object.prototype.__proto__ accessors and using a WebAssembly.compileStreaming rejection to surface a host TypeError, an attacker severs a host prototype chain, causing the bridge's proto-walk to return the raw host error unwrapped - yielding e.constructor.constructor as host Function and full RCE. Publicly available exploit code exists (advisory ships a working PoC); CVSS is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Improper delegation of file handling in the LXQt PCManFM-Qt file manager (all releases from 1.1.0 through 2.4.0) allows a local attacker to trigger execution of arbitrary handler programs by passing a regular file's path as a URI to the org.freedesktop.FileManager1.ShowFolders D-Bus method, which opens the file with its type-associated program without user confirmation. This can yield code execution or be abused to circumvent network namespace restrictions. EPSS is negligible (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, but SSVC rates the technical impact as total.
Safety-guard bypass in the Spring Framework SpEL engine (VMware/Broadcom) lets attacker-controlled expression input escape the restricted SimpleEvaluationContext sandbox when the SpEL bytecode compiler is active, affecting Spring Framework 5.2.x through 7.0.8 across the 5.3, 6.0, 6.1, 6.2 and 7.0 lines. Because SimpleEvaluationContext is the API applications are told to use to safely evaluate untrusted expressions, this bypass can escalate a data-binding-only context into broader method invocation with high integrity and availability impact (CVSS 9.1, CWE-913). There is no public exploit identified at time of analysis, and EPSS is low (0.16%, 5th percentile), indicating no observed mass exploitation yet.
Sandbox escape in Google Chrome's Linux Toolkit Theming component (prior to 151.0.7922.173) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox via a crafted HTML page. This is a two-stage attack: the renderer must be compromised first, then this CWE-913 flaw in the theming subsystem is leveraged to break out of the sandbox entirely, achieving host-level code execution. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.38% (32nd percentile), consistent with an absence of observed mass exploitation.
Privilege escalation in the search-v2-operator (Red Hat Advanced Cluster Management / OpenShift search component) allows a user with edit rights on the Search Custom Resource to abuse unvalidated CR fields (imageOverride, arguments, environment variables) to load an attacker-controlled container image or mount arbitrary secrets. Because the search ServiceAccount holds broad impersonation permissions, controlling that pod pivots into full cluster compromise. No public exploit is identified at time of analysis, and it is not listed in CISA KEV; the CVSS 9.1 rating reflects the scope change from a namespaced CR editor to the entire cluster.
Sandbox escape in the vm2 Node.js sandboxing library (npm, versions <= 3.11.5) lets code running inside the sandbox reach host prototype mutators and execute arbitrary OS commands on the host. It bypasses the earlier GHSA-v6mx-mf47-r5wg fix by stacking Function.prototype.call indirection so the dangerous __proto__ setter is no longer in the inspected position, then leaks a live host reference through a rejected WebAssembly.compileStreaming promise to pivot to child_process. A working proof-of-concept is published in the advisory, so publicly available exploit code exists; the flaw is not listed in CISA KEV.
Unintended internal method dispatch in electerm prior to v3.15.186 allows any authenticated WebSocket client to invoke arbitrary Upgrade and filesystem export methods - including OS command execution, file mutation, and process termination - by supplying attacker-controlled function names to the `upgrade-func` and `handleFs` WebSocket handlers. The root cause is the absence of allowlist validation in `src/app/server/dispatch-center.js` and `src/app/server/fs.js`, where client-supplied `func` strings were passed directly to dynamic method calls, including paths exploitable via JavaScript prototype chain traversal. No public exploit or CISA KEV listing exists at time of analysis; CVSS 8.8 reflects the high impact and low complexity once a valid authenticated session is held.
Sandbox escape in vm2 (npm package, versions <= 3.11.3) allows arbitrary code execution in the Node.js host process when untrusted code is run on runtimes exposing WebAssembly JSPI (Node 24 with --experimental-wasm-jspi, or Node 26+ by default). A working PoC demonstrates that a JSPI-backed Promise reaches host-realm Promise.prototype.finally without bridge interposition, letting attacker-controlled species logic walk a rejection object's constructor chain to host process and execute arbitrary commands. No public exploit identified as actively used in the wild, but a complete weaponized PoC is published in the GHSA advisory.
Sandbox escape in vm2 (npm package, versions <= 3.11.3) allows full remote code execution by bypassing the GHSA-8hg8-63c5-gwmx (CVE-2023-37903) patch through omission of the require option when nesting:true is set. Publicly available exploit code exists in the GHSA advisory itself, and with a CVSS of 10.0 (AV:N/AC:L/PR:N/UI:N/S:C) any application passing untrusted code to a NodeVM configured this way is trivially compromised on the host.
Remote code execution in the vm2 Node.js sandbox library (versions <= 3.11.3) allows sandboxed JavaScript to escape isolation and execute arbitrary commands on the host. The flaw stems from a missing resetPromiseSpecies call in the localPromise swallow tail, letting a sandbox subclass hijack Promise species resolution and capture a raw host-realm RangeError that exposes the host Function constructor. Publicly available exploit code exists (POC published in the advisory), though no public exploit identified at time of analysis as actively exploited in the wild; given vm2's heavy use as an untrusted-code sandbox in SaaS, CI, and serverless platforms, this is a top-priority issue.
Sandbox escape in the vm2 Node.js sandbox library (versions <= 3.11.3) allows untrusted JavaScript executed inside a vm2 VM to reach the host realm and achieve arbitrary code execution. By chaining Buffer.call.call indirection with __lookupGetter__/__lookupSetter__ to obtain host Object.prototype.__proto__ accessors and using a WebAssembly.compileStreaming rejection to surface a host TypeError, an attacker severs a host prototype chain, causing the bridge's proto-walk to return the raw host error unwrapped - yielding e.constructor.constructor as host Function and full RCE. Publicly available exploit code exists (advisory ships a working PoC); CVSS is 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).
Improper delegation of file handling in the LXQt PCManFM-Qt file manager (all releases from 1.1.0 through 2.4.0) allows a local attacker to trigger execution of arbitrary handler programs by passing a regular file's path as a URI to the org.freedesktop.FileManager1.ShowFolders D-Bus method, which opens the file with its type-associated program without user confirmation. This can yield code execution or be abused to circumvent network namespace restrictions. EPSS is negligible (0.01%, 2nd percentile) and there is no public exploit identified at time of analysis, but SSVC rates the technical impact as total.