Critical vm2 Sandbox Escape Vulnerability Allows Host System Takeover

·1 views

A critical vulnerability identified as CVE-2026-92951 has been discovered in the vm2 JavaScript sandbox library. The flaw, with a CVSS score of 9.9, allows attackers to bypass the package allowlist through incorrect authorization and directory traversal. This enables sandboxed code to execute arbitrary packages on the host filesystem with full privileges. The vulnerability affects vm2 versions before 3.11.7, primarily impacting systems running untrusted code. Developers are urged to upgrade to version 3.11.7 or implement stronger isolation mechanisms.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Models Show Bias in Indian Context Benchmark Study

A study benchmarked frontier AI models using field data from 123 university students in Goa, India. Researchers tested models on 24 real institutional disputes across education, healthcare, justice and finance sectors. The benchmark measured four metrics including ambiguity resistance, demographic parity, persona sycophancy and human alignment. Results showed all evaluated models failed to achieve demographic parity in their decisions. The study highlights how current AI evaluations using Western templates may not capture model behavior in diverse cultural contexts.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer finds uncalibrated AI website classifier reduces conversion rates.

A developer created a website, Evolve, that dynamically rewrites its content for different visitor segments using a genetic algorithm and an AI classifier called Laya. The system assigns visitors to segments like 'recruiter' or 'developer' and serves optimized page variants based on their predicted interests. Testing revealed that using a poorly calibrated classifier for segmentation resulted in lower conversion rates than using no segmentation at all. The project concluded that calibration is critical for an AI routing system to perform safely and effectively.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

AI in schools prompts ethical questions about its role in student wellbeing

Artificial intelligence is increasingly integrated into education for tasks like lesson planning, study assistance, and administrative support. Developers are now creating tools that interact with students' emotions and wellbeing, raising ethical concerns. The key question is not the technical capabilities of AI but where its role in student wellbeing should begin and end. Experts argue such tools require careful design, strong privacy safeguards, and clear boundaries to avoid replacing crucial human relationships. Applications focused on practical, non-judgmental support, like organizing resources or providing general prompts, are seen as more appropriate than those attempting to diagnose or counsel.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Guide: Using a Disposable macOS VM to Safely Test Untrusted Software on Apple Silicon

A technical guide recommends creating a macOS virtual machine to test potentially untrusted applications safely. This approach provides an isolated environment on Apple Silicon Macs, keeping the host system's files and data separate from the software being tested. The process involves creating a clean VM, using a cloned copy for testing, and avoiding sharing sensitive host directories. The method is intended for cautious evaluation of unverified software, not for analyzing malicious malware.

0 comments Read more at DEV Community