Critical vm2 sandbox flaw allows host system command execution

·4 views

A critical vulnerability designated CVE-2026-92957 was published on October 1, 2026, affecting the vm2 sandbox package. The flaw exists in versions 3.11.6 and earlier of vm2's NodeVM component. It allows sandboxed code to bypass security policies and load restricted host modules like child_process. This bypass occurs due to improper handling of the 'node:' prefix in policy configuration, enabling remote code execution on the host system. The issue is fixed in version 3.11.7 of the vm2 package.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Expert outlines technical requirements for a verifiable data audit workbench

A data audit workbench is defined as a repeatable pipeline that transforms control events into immutable, verifiable records for regulatory inspection. It must mechanically write events to append-only, write-once-read-many (WORM) storage with enforced retention periods to meet compliance standards. Key design considerations include using cryptographic hash chains to prove event integrity and making practical choices between global and sharded chains for performance. The system must also reconcile immutable logs with data erasure requests using patterns like salted hashes and maintain backward-compatible schemas for long-term parseability.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer creates open-source AI meeting assistant that searches transcripts conversationally

A developer created an open-source AI meeting assistant called Fathom Rebuild during a Hacktoberfest challenge. The tool processes meeting transcripts to extract decisions, action items, and highlights. Users can ask questions across multiple meetings and receive answers with references to source transcripts. The application uses LangChain, LangGraph, and Groq for AI inference in an agentic workflow. The project was built for a friend who frequently needs to retrieve specific information from lengthy meeting records.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Systemd tool automates LUKS disk unlock using TPM or FIDO tokens

The systemd-cryptenroll tool allows Linux users to automate unlocking LUKS2-encrypted disks at boot. It replaces manual passphrase entry with hardware-based authentication like TPM2 chips or FIDO2 security keys. This functionality is particularly useful for servers or homelab equipment that must restart automatically after power loss. The tool stores unlock metadata within the LUKS2 volume's JSON token area. Users are advised to maintain their original passphrase and create recovery keys before implementing these automated methods.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Python Scripts Automate PDF Invoice Extraction to Save Work Hours

Businesses and freelancers can automate the manual processing of PDF invoices using Python, saving significant time. A well-designed script can extract and structure data from invoices, reducing human error and standardizing the workflow. Python is favored for this task due to its specialized libraries for PDF manipulation and text extraction. This automation can be integrated into accounting systems and scheduled to run without human intervention.

0 comments Read more at DEV Community