Oran-S

**Name of the Vulnerable Software and Affected Versions** vm2 versions 3.11.0 through 3.11.6 **Description** Absolute host filesystem paths are leaked to sandboxed code via error stack formatting. An attacker can force the host-realm source transformer to throw a `SyntaxError` by calling `eval` with malformed source and subsequently reading the `.stack` property of the error. The bridge forwards this read to the host-realm formatter, bypassing host-path redaction. This results in the disclosure of absolute paths from the software, Node.js internals, and the embedding application's source tree, as well as host function names. This issue affects default `new VM()` and `new NodeVM()` configurations and persists even if string eval is disabled. The impact is limited to information disclosure. **Recommendations** Update to version 3.11.7.

**Name of the Vulnerable Software and Affected Versions** vm2 versions 3.9.6 through 3.11.6 **Description** Insufficient restriction of access to accessor properties on frozen objects allows sandboxed scripts to bypass protections provided by `vm.freeze()` and `vm.readonly()`. Attackers can utilize `Object.getOwnPropertyDescriptor()` or ` lookupSetter ()` to extract and invoke host object setters directly, enabling the mutation of properties that were explicitly marked as read-only by the embedder. **Recommendations** Update vm2 to version 3.11.7 or later.

**Name of the Vulnerable Software and Affected Versions** vLLM versions prior to 0.28.0 **Description** Authenticated clients can bypass duration checks in the transcription endpoint because the system fails to validate audio sample rate headers. By submitting forged FLAC headers with inflated sample rates, an attacker can trigger excessive memory allocation, leading to a crash of the API server process that affects all tenants. **Recommendations** Update to version 0.28.0 or later.

**Name of the Vulnerable Software and Affected Versions** vm2 version 3.11.6 **Description** A sandbox escape allows remote code execution in the host Node.js process. The issue occurs because the bridge gate at `lib/bridge.js:1624` only performs identity-checks on the direct call target when deciding whether to sanitize a rejected host Promise value. By registering a rejection handler through `Function.prototype.call` or `.apply` indirection, the sanitizer is bypassed, allowing raw host errors to reach the sandbox code. If a host-realm Promise is exposed to the sandbox and rejects with an Error containing a non-primitive own property that references a host object, untrusted code can obtain a proxy to that host object and execute arbitrary commands with host process privileges. **Recommendations** Update vm2 to version 3.11.7.

**Name of the Vulnerable Software and Affected Versions** vm2 versions prior to 3.11.7 **Description** A sandbox escape exists in the CLI tool that enables arbitrary code execution within the host Node.js process. An attacker can provide a malicious script file to the CLI that utilizes `require( filename)` to re-execute itself in the host realm. This action bypasses sandbox isolation, granting unauthorized access to host modules such as `fs` and `child process`. **Recommendations** Update vm2 to version 3.11.7 or later.