CVE-2019-10761

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a child_process and execute arbitrary code.

• CWE-674

• https://github.com/patriksimek/vm2/commit/4b22d704e4794af63a5a2d633385fd20948f6f90Patch, Third Party Advisory
• https://github.com/patriksimek/vm2/issues/197Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-VM2-473188Third Party Advisory
• https://github.com/patriksimek/vm2/commit/4b22d704e4794af63a5a2d633385fd20948f6f90Patch, Third Party Advisory
• https://github.com/patriksimek/vm2/issues/197Exploit, Third Party Advisory
• https://snyk.io/vuln/SNYK-JS-VM2-473188Third Party Advisory

Published

Jul 13, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-10756It is possible to inject JavaScript within node-red-dashboar…5.4
• CVE-2019-10757knex.js versions before 0.19.5 are vulnerable to SQL Injecti…9.8
• CVE-2019-10758mongo-express before 0.54.0 is vulnerable to Remote Code Exe…9.9
• CVE-2019-10759safer-eval before 1.3.4 are vulnerable to Arbitrary Code Exe…9.9
• CVE-2019-1076A Cross-site Scripting (XSS) vulnerability exists when Team …
• CVE-2019-10760safer-eval before 1.3.2 are vulnerable to Arbitrary Code Exe…9.9
• CVE-2019-10762columnQuote in medoo before 1.7.5 allows remote attackers to…9.8
• CVE-2019-10763pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection.…6.5
• CVE-2019-10764In elliptic-php versions priot to 1.0.6, Timing attacks migh…7.4
• CVE-2019-10765iobroker.admin before 3.6.12 allows attacker to include file…9.8
• CVE-2019-10766Pixie versions 1.0.x before 1.0.3, and 2.0.x before 2.0.2 al…9.8
• CVE-2019-10767An attacker can include file contents from outside the `/ada…7.5