sandbox escape
-
vm2 library hit by a dozen critical Node.js sandbox escape flaws
A dozen critical vm2 vulnerabilities disclosed on May 7, 2026 can let attackers escape Node.js sandboxes, run code on the host and bypass allowlists. Fixes are available in vm2 3.11.2 and earlier patch releases.
-
Cohere AI Terrarium sandbox flaw can let attackers run code as root
A critical flaw in Cohere AI’s Terrarium Python sandbox could allow arbitrary code execution as root, with CERT/CC warning that the bug may let attackers escape the sandbox and reach host or container resources.
-
Google patched Antigravity sandbox escape bug after prompt injection research
Google fixed an Antigravity vulnerability after researchers said prompt injection could combine with a file-creation capability to bypass secure mode and enable remote code execution in the AI developer tool.
-
Critical vm2 sandbox escape CVE-2026-22709 allows arbitrary code execution
A critical sandbox escape in the vm2 Node.js library, tracked as CVE-2026-22709 and rated CVSS 9.8, lets attackers run code on host systems. Users should update to vm2 3.10.3.
-
Two n8n sandbox escape flaws allow remote code execution
JFrog Security Research disclosed two eval injection flaws in n8n that can bypass sandboxes and allow remote code execution. One is rated CVSS 9.9. Users are advised to update affected versions.
