GrepRules
Sign inPublish rule
Explore

Rule Explorer

Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.

Public rules
6965
Downloads
12.9M
Verified
6965
Authors
2
Search the rule indexUse CVE, GHSA, CWE, language, framework, package, or rule slug.
1 rules matched. Showing 1 loaded rules.
Publish rule
CVE-2026-92960: Js Vm2 Node Builtin Denylist Missing Os Dnscve-2026-92960-js-vm2-node-builtin-denylist-missing-os-dns

Incomplete sandbox builtin denylist: this Node-builtin policy table enumerates the known process-wide host-state builtins (module, worker_threads, cluster, inspector, process, ...) but does not deny `os` and `dns`. Every enforcement layer keyed off this table (the `'*'` wildcard expansion and the explicit-allowlist / makeBuiltins rejection) still hands sandb

JSNode.jsCVE-2026-92960GHSA-M5W8-4GQ2-6F8XGHSA-m5w8-4gq2-6f8xCWE-200
by Provallyupdated 2026-10-27Apache-2.0
480 direct48 via packs
83
All matching rules loaded.