Advisories · Weakness
CWE-1100.
Every Advisory and CVE whose sources give the weakness CWE-1100, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
- Information disclosure
- CWE-1100
<3.11.2 · fixed in 3.11.2
GHSA-9qj6-qjgg-37qq · CVE-2026-44008 - CVSS 9.1 CriticalCritical · CVSS 9+
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
- Broken access control
- CWE-693
<3.11.1 · fixed in 3.11.1
GHSA-8hg8-63c5-gwmx · CVE-2026-44007 - CVSS 9.8 CriticalCritical · CVSS 9+
Unsanitized Input in langgenius/dify
- langgenius/dify
- CWE-1100
- CVSS 4.3 Medium
Open WebUI Has Improper Access Control Leading to Arbitrary Prompt Read
- Broken access control
- CWE-1100
<=0.3.8 · no fixed version yet
GHSA-c7fq-p62p-wvpc · CVE-2024-7045 - CVSS 6.5 Medium
Unauthorized Access in danswer-ai/danswer
- danswer-ai/danswer
- CWE-1100