{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-100722", "tracking": { "current_release_date": "2026-10-05T23:40:13.141102Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-100722", "initial_release_date": "2026-09-27T02:25:33.828346Z", "revision_history": [ { "date": "2026-09-27T02:25:33.828346Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (2).| CWES updated (1)." }, { "date": "2026-09-27T02:25:35.046657Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-09-27T12:15:01.936960Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products created (1).| Products connected (36).| References created (4).| CWES updated (1)." }, { "date": "2026-09-27T12:15:14.866809Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-09-27T15:15:12.110030Z", "number": "5", "summary": "EPSS created.| Unknown change." }, { "date": "2026-09-27T15:16:24.292750Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-09-28T11:32:11.144393Z", "number": "7", "summary": "Source connected.| CVE status created. (valid)| Products connected (1).| References created (6)." }, { "date": "2026-09-28T11:32:14.819920Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-09-28T12:42:02.845224Z", "number": "9", "summary": "CVSS created.| CWES created (1).| Products created (2).| References created (2).| Description created for source.| Unknown change." }, { "date": "2026-09-28T12:42:05.567534Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-09-28T14:38:38.045953Z", "number": "11", "summary": "Unknown change." }, { "date": "2026-09-29T12:42:47.415114Z", "number": "12", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (7).| Product Identifiers created (2).| References created (4).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-09-29T12:42:55.817054Z", "number": "13", "summary": "NCSC Score updated." }, { "date": "2026-09-29T16:13:24.645156Z", "number": "14", "summary": "EPSS created.| Unknown change." }, { "date": "2026-10-05T23:40:01.123041Z", "number": "15", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (6).| CWES updated (1)." }, { "date": "2026-10-05T23:40:04.018223Z", "number": "16", "summary": "NCSC Score updated." } ], "status": "interim", "version": "16" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-1508265", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhdh:1" } } } ], "category": "product_name", "name": "Red Hat Developer Hub" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/2", "product": { "name": "vers:rpm/2", "product_id": "CSAFPID-5486263", "product_identification_helper": { "cpe": "cpe:/a:redhat:ansible_portal:2" } } } ], "category": "product_name", "name": "Self-service automation portal 2" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-5486265" } } ], "category": "product_name", "name": "automation-portal" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8334394" } } ], "category": "product_name", "name": "bootc-automation-portal-rhel9" } ], "category": "product_family", "name": "Self-service automation portal 2" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8927912" } } ], "category": "product_name", "name": "red-hat-developer-hub-backstage-plugin-lightspeed-backend" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8927914" } } ], "category": "product_name", "name": "red-hat-developer-hub-backstage-plugin-orchestrator-backend" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-1508266" } } ], "category": "product_name", "name": "rhdh-hub-rhel9" } ], "category": "product_family", "name": "Red Hat Developer Hub" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/<3.12.2", "product": { "name": "vers:unknown/<3.12.2", "product_id": "CSAFPID-9477908" } } ], "category": "product_name", "name": "vm2" } ], "category": "vendor", "name": "Open Source" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:semver/3.12.2", "product": { "name": "vers:semver/3.12.2", "product_id": "CSAFPID-9478885" } }, { "category": "product_version_range", "name": "vers:semver/<3.12.2", "product": { "name": "vers:semver/<3.12.2", "product_id": "CSAFPID-9478886" } }, { "category": "product_version_range", "name": "vers:unknown/3.11.6", "product": { "name": "vers:unknown/3.11.6", "product_id": "CSAFPID-9337227" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.10", "product": { "name": "vers:unknown/3.9.10", "product_id": "CSAFPID-3466137" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.11", "product": { "name": "vers:unknown/3.9.11", "product_id": "CSAFPID-3466138" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.12", "product": { "name": "vers:unknown/3.9.12", "product_id": "CSAFPID-3466139" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.13", "product": { "name": "vers:unknown/3.9.13", "product_id": "CSAFPID-3466140" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.14", "product": { "name": "vers:unknown/3.9.14", "product_id": "CSAFPID-3466141" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.15", "product": { "name": "vers:unknown/3.9.15", "product_id": "CSAFPID-3466142" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.16", "product": { "name": "vers:unknown/3.9.16", "product_id": "CSAFPID-3466143" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.17", "product": { "name": "vers:unknown/3.9.17", "product_id": "CSAFPID-4139275" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.18", "product": { "name": "vers:unknown/3.9.18", "product_id": "CSAFPID-4139276" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.19", "product": { "name": "vers:unknown/3.9.19", "product_id": "CSAFPID-4139277" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.3", "product": { "name": "vers:unknown/3.9.3", "product_id": "CSAFPID-3466144" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.4", "product": { "name": "vers:unknown/3.9.4", "product_id": "CSAFPID-3466145" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.5", "product": { "name": "vers:unknown/3.9.5", "product_id": "CSAFPID-3466146" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.6", "product": { "name": "vers:unknown/3.9.6", "product_id": "CSAFPID-3466147" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.7", "product": { "name": "vers:unknown/3.9.7", "product_id": "CSAFPID-3466148" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.8", "product": { "name": "vers:unknown/3.9.8", "product_id": "CSAFPID-3466149" } }, { "category": "product_version_range", "name": "vers:unknown/3.9.9", "product": { "name": "vers:unknown/3.9.9", "product_id": "CSAFPID-3466150" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.0", "product": { "name": "vers:unknown/v3.10.0", "product_id": "CSAFPID-5467538" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.1", "product": { "name": "vers:unknown/v3.10.1", "product_id": "CSAFPID-5467539" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.2", "product": { "name": "vers:unknown/v3.10.2", "product_id": "CSAFPID-8609298" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.3", "product": { "name": "vers:unknown/v3.10.3", "product_id": "CSAFPID-8609297" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.4", "product": { "name": "vers:unknown/v3.10.4", "product_id": "CSAFPID-8609296" } }, { "category": "product_version_range", "name": "vers:unknown/v3.10.5", "product": { "name": "vers:unknown/v3.10.5", "product_id": "CSAFPID-8609295" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.0", "product": { "name": "vers:unknown/v3.11.0", "product_id": "CSAFPID-8707556" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.1", "product": { "name": "vers:unknown/v3.11.1", "product_id": "CSAFPID-8707555" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.2", "product": { "name": "vers:unknown/v3.11.2", "product_id": "CSAFPID-8707554" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.3", "product": { "name": "vers:unknown/v3.11.3", "product_id": "CSAFPID-8707553" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.4", "product": { "name": "vers:unknown/v3.11.4", "product_id": "CSAFPID-9007705" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.5", "product": { "name": "vers:unknown/v3.11.5", "product_id": "CSAFPID-9007704" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.7", "product": { "name": "vers:unknown/v3.11.7", "product_id": "CSAFPID-9344037" } }, { "category": "product_version_range", "name": "vers:unknown/v3.11.8", "product": { "name": "vers:unknown/v3.11.8", "product_id": "CSAFPID-9358171" } }, { "category": "product_version_range", "name": "vers:unknown/v3.12.0", "product": { "name": "vers:unknown/v3.12.0", "product_id": "CSAFPID-9358170" } }, { "category": "product_version_range", "name": "vers:unknown/v3.12.1", "product": { "name": "vers:unknown/v3.12.1", "product_id": "CSAFPID-9474627" } }, { "category": "product_version_range", "name": "vers:unknown/v3.9.0", "product": { "name": "vers:unknown/v3.9.0", "product_id": "CSAFPID-3466151" } }, { "category": "product_version_range", "name": "vers:unknown/v3.9.1", "product": { "name": "vers:unknown/v3.9.1", "product_id": "CSAFPID-3466152" } }, { "category": "product_version_range", "name": "vers:unknown/v3.9.2", "product": { "name": "vers:unknown/v3.9.2", "product_id": "CSAFPID-3466153" } } ], "category": "product_name", "name": "vm2" } ], "category": "vendor", "name": "patriksimek" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-100722", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "notes": [ { "category": "description", "text": "vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-100722" }, { "category": "description", "text": "vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.\nA flaw was found in vm2. An attacker who can execute untrusted code within the sandbox can trigger an unhandled error by instantiating host-provided functions that return a rejected asynchronous operation (Promise). Due to missing error handling in the sandbox-to-host object construction trap, the unhandled failure crosses into the host runtime. This condition causes the host application to terminate unexpectedly, resulting in a Denial of Service (DoS).", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-100722" }, { "category": "description", "text": "## Summary\n\nAn untrusted script run by `VM.run` can construct an embedder-exposed host function that returns a rejected native Promise and ignore the result. The sandbox-to-host `construct` trap forwards that Promise without applying the host-side rejection handling already used by the neighboring `apply` trap, so Node's strict unhandled-rejection policy terminates the host process.\n\n## Technical Details\n\nThe precondition is an application-supplied constructable host function in the VM sandbox whose constructor body returns a native rejected Promise. In JavaScript, an object explicitly returned by a constructor replaces the newly allocated instance, so `new HostReject()` produces that Promise.\n\n`VM.run` executes the attacker-controlled source. For an ordinary host-function call, `BaseHandler.apply` invokes the host function, calls `markHostPromiseHandled(ret)`, and then wraps the result. The adjacent `BaseHandler.construct` path instead calls `Reflect.construct` and returns `thisFromOtherWithFactory(...)` without calling the same sanitizer. The rejected host Promise therefore crosses the bridge still unhandled. With Node's strict unhandled-rejection behavior, the rejection is promoted to an uncaught exception and kills the host process.\n\nThe shortest path is `VM.run` → the sandbox bridge → `BaseHandler.construct`. The control changes only the guest expression: it attaches `.catch(function () {})` to the constructed Promise before ignoring it. The host function, VM configuration, rejection, and Node policy remain the same, and the control process survives.\n\nThis is unintended because the repository's GHSA-gjq8 hardening explicitly marks host Promises handled at the apply boundary, while no equivalent handling exists in the adjacent construct return path. The construct path is a distinct boundary and fix surface, not a second invocation of the already-fixed apply path.\n\n## PoV\n\nSave the following as `construct-promise-poc.js`:\n\n```js\n'use strict';\n\nconst { VM } = require(process.cwd() + '/lib/main.js');\n\nfunction HostReject() {\n return Promise.reject(new Error('constructed-host-boom'));\n}\n\nconst mode = process.argv[2];\nconst vm = new VM({ sandbox: { HostReject } });\n\nif (mode === 'vulnerable') {\n console.log('VULNERABLE_STARTED');\n vm.run('new HostReject(); 1');\n setTimeout(() => console.log('ALIVE'), 300);\n} else if (mode === 'control') {\n vm.run('new HostReject().catch(function () {}); 1');\n setTimeout(() => console.log('CONTROL_ALIVE'), 300);\n} else {\n throw new Error('usage: node construct-promise-poc.js vulnerable|control');\n}\n```\n\n## PoC\n\nCheck out vm2 revision `91034466bfb7f56b95fd48083ec6ca36d058f164`, install its declared dependencies with `npm ci --ignore-scripts`, and save `construct-promise-poc.js` in that checkout's module root (the directory containing `package.json` and `lib/`). Run the script and both commands below from that same module-root directory. The script resolves `lib/main.js` from the current directory, so the test uses the checked-out vm2 source.\n\nTested with vm2 `3.11.8` at that revision on Node.js `v26.8.1`, with `NODE_OPTIONS=--unhandled-rejections=strict`. The abort flag makes the process crash signal explicit:\n\n```text\nNODE_OPTIONS=--unhandled-rejections=strict node --abort-on-uncaught-exception construct-promise-poc.js vulnerable\n```\n\nAbridged vulnerable output:\n\n```text\nVULNERABLE_STARTED\nError: constructed-host-boom\n at VM2 Wrapper.construct (.../lib/bridge.js:2340:11)\n at VM.run (.../lib/vm.js:613:16)\n```\n\nThe process exits before printing `ALIVE` (exit status 139 in the tested execution). The stack paths are environment-dependent; the `construct` and `VM.run` frames identify the relevant target functions.\n\nThe otherwise identical control is:\n\n```text\nNODE_OPTIONS=--unhandled-rejections=strict node --abort-on-uncaught-exception construct-promise-poc.js control\n```\n\nControl output:\n\n```text\nCONTROL_ALIVE\n```\n\nThe control exits successfully. The crash is a process-level availability failure, not a guest exception caught and returned by `VM.run`.\n\n## Impact\n\nAn attacker who can submit JavaScript to a VM and who receives a constructable Promise-returning host API can terminate the Node.js process hosting the sandbox with one expression. This can take down a plugin worker, notebook kernel, queue consumer, or multi-tenant execution worker serving other users. The exploit does not require filesystem access, a Node builtin, nested VMs, or host compromise. It requires the embedder to expose the host constructor and the host to use strict unhandled-rejection handling.\n\nThe impact is host availability only; this report does not claim confidentiality or integrity impact. The typed classification is CWE-248 (Uncaught Exception) and CWE-703 (Improper Check or Handling of Exceptional Conditions), with CVSS 3.1 `AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H` (8.6, High) for a deployment that accepts untrusted code over a network boundary.\n\n## Suggested Fix\n\nRestore the bridge invariant that every host-native Promise crossing into the sandbox is marked handled before it can be ignored. In `BaseHandler.construct`, add the same `markHostPromiseHandled(ret)` call used by `BaseHandler.apply`, after the host result is produced and before it is converted and returned:\n\n```js\nstripDangerousSymbolsFromHostResult(ret);\nmarkHostPromiseHandled(ret);\nreturn thisFromOtherWithFactory(getHandlerFactory(this), ret, thisFromOther(object));\n```\n\nThe call should attach the benign host-side rejection reaction without changing the Promise value or preventing sandbox code that later attaches `.catch()` or `.then(..., onRejected)` from observing the rejection. Regression tests should cover an ignored rejected Promise returned through `new`, the caught control, ordinary non-Promise constructor returns, and the existing apply-path behavior.\n\n## Affected Package/Versions\n\n- Package: `vm2` (npm).\n- Confirmed vulnerable: `3.11.8`, including revision `91034466bfb7f56b95fd48083ec6ca36d058f164`.\n- The exact tested affected range is `3.11.8`; no broader version range is inferred from this test.\n\n## Advisory History\n\nThe public [GHSA-gjq8-xm47-88rc advisory](https://github.com/patriksimek/vm2/security/advisories/GHSA-gjq8-xm47-88rc) describes host-returned Promise rejection termination and records `3.11.8` as its patched version. Its fix and reproduction cover a host function invoked through the bridge `apply` route. This report uses the distinct `construct` route reached by `new`, where the tested `3.11.8` source still omits `markHostPromiseHandled(ret)`. A fix for `apply` does not automatically fix this adjacent return path.\n\nThe checked related public history includes [GHSA-hw58-p9xv-2mjh](https://github.com/patriksimek/vm2/security/advisories/GHSA-hw58-p9xv-2mjh), the earlier sandbox-Promise constructor issue. GHSA-hw58 concerns an error raised by a Promise executor for a Promise created inside the sandbox; it is the sandbox-native `localPromise`/executor path, not GHSA-gjq8's host-returned Promise through `BaseHandler.apply` and not this host-constructor result through `BaseHandler.construct`.\n\nThe checked search also found [PR #421, “Handle errors thrown in async functions”](https://github.com/patriksimek/vm2/pull/421). That is a separate async-error history item concerning errors from async functions and timer callbacks, with general unhandled-rejection handling, rather than a host Promise returned through the GHSA-gjq8 `apply` boundary or a Promise returned by an exposed constructor through this `construct` trap.\n\nThe bound prior local report, titled “NodeVM crypto sanitizer exposes process-wide crypto.setFips,” covers a different root cause: an allowlisted `crypto` builtin exposes `setFips`, allowing guest code to mutate host-wide cryptographic state. Its boundary and fix surface are builtin sanitization and process-state mutation, not host-Promise rejection handling; it therefore differs from both the GHSA-gjq8 `apply` route and this `BaseHandler.construct` route. No prior report covering this construct-trap root cause was found.", "title": "github - https://github.com/advisories/GHSA-2v2p-6j97-cjg9" }, { "category": "description", "text": "vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-100722" }, { "category": "description", "text": "vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls markHostPromiseHandled() on the returned value, but the adjacent construct path returns the result of Reflect.construct without the same sanitization. If an embedder exposes a constructable host function whose constructor returns a native rejected Promise, an untrusted script executed via VM.run can invoke it with `new` and ignore the result; the rejected host Promise crosses the bridge unhandled and, under Node's strict unhandled-rejection policy, is promoted to an uncaught exception that terminates the host process.", "title": "osv - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100722.json?alt=media" }, { "category": "other", "text": "0.0026", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "title": "CVSSV4" }, { "category": "other", "text": "8.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "4.2", "title": "NCSC Score" }, { "category": "other", "text": "There is product data available from source Certbundde, The value of the most recent CVSS (V4) score", "title": "NCSC Score top increasing factors" }, { "category": "other", "text": "There is cwe data available from source Github, Is related to CWE-248 (Uncaught Exception), Is related to a product by vendor Open Source, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-3466137", "CSAFPID-3466138", "CSAFPID-3466139", "CSAFPID-3466140", "CSAFPID-3466141", "CSAFPID-3466142", "CSAFPID-3466143", "CSAFPID-3466144", "CSAFPID-3466145", "CSAFPID-3466146", "CSAFPID-3466147", "CSAFPID-3466148", "CSAFPID-3466149", "CSAFPID-3466150", "CSAFPID-3466151", "CSAFPID-3466152", "CSAFPID-3466153", "CSAFPID-4139275", "CSAFPID-4139276", "CSAFPID-4139277", "CSAFPID-5467538", "CSAFPID-5467539", "CSAFPID-8609295", "CSAFPID-8609296", "CSAFPID-8609297", "CSAFPID-8609298", "CSAFPID-8707553", "CSAFPID-8707554", "CSAFPID-8707555", "CSAFPID-8707556", "CSAFPID-9007704", "CSAFPID-9007705", "CSAFPID-9337227", "CSAFPID-9344037", "CSAFPID-9358170", "CSAFPID-9358171", "CSAFPID-9474627", "CSAFPID-9477908", "CSAFPID-9478886", "CSAFPID-1508265", "CSAFPID-1508266", "CSAFPID-5486263", "CSAFPID-5486265", "CSAFPID-8334394", "CSAFPID-8927912", "CSAFPID-8927914" ], "known_not_affected": [ "CSAFPID-9478885" ] }, "references": [ { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100722" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-100722" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-100722.json?alt=media" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Source - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3594.json" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100722" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-100722" }, { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-2v2p-6j97-cjg9" }, { "category": "external", "summary": "Reference - certbundde; cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2v2p-6j97-cjg9" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://www.vulncheck.com/advisories/vm2-before-3.12.2-host-process-termination-via-construct-trap" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100722.json" }, { "category": "external", "summary": "Reference - github; osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-100722" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3594.json" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2026-3594" }, { "category": "external", "summary": "Reference - certbundde; github", "url": "https://github.com/patriksimek/vm2/releases/tag/v3.12.2" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-489w-w794-jq94" }, { "category": "external", "summary": "Reference - certbundde", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-5h3f-q97h-ccvc" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-100722" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/patriksimek/vm2/commit/6e487df9518e455e5e60faec3df3a0e2e27f9940" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-2v2p-6j97-cjg9" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:H", "baseScore": 8.6, "baseSeverity": "HIGH" }, "products": [ "CSAFPID-1508265", "CSAFPID-1508266", "CSAFPID-3466137", "CSAFPID-3466138", "CSAFPID-3466139", "CSAFPID-3466140", "CSAFPID-3466141", "CSAFPID-3466142", "CSAFPID-3466143", "CSAFPID-3466144", "CSAFPID-3466145", "CSAFPID-3466146", "CSAFPID-3466147", "CSAFPID-3466148", "CSAFPID-3466149", "CSAFPID-3466150", "CSAFPID-3466151", "CSAFPID-3466152", "CSAFPID-3466153", "CSAFPID-4139275", "CSAFPID-4139276", "CSAFPID-4139277", "CSAFPID-5467538", "CSAFPID-5467539", "CSAFPID-5486263", "CSAFPID-5486265", "CSAFPID-8334394", "CSAFPID-8609295", "CSAFPID-8609296", "CSAFPID-8609297", "CSAFPID-8609298", "CSAFPID-8707553", "CSAFPID-8707554", "CSAFPID-8707555", "CSAFPID-8707556", "CSAFPID-8927912", "CSAFPID-8927914", "CSAFPID-9007704", "CSAFPID-9007705", "CSAFPID-9337227", "CSAFPID-9344037", "CSAFPID-9358170", "CSAFPID-9358171", "CSAFPID-9474627", "CSAFPID-9477908", "CSAFPID-9478886" ] } ], "title": "CVE-2026-100722" } ] }