---
title: "Security digest: August 17, 2026"
url: https://erroneo.us/security/2026-08-17/
description: "August 17, 2026 vulnerability digest: 1 brief (vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2); 1 CISA KEV addition (Ray-Project); 7 critical advisories…"
type: security-digest-day
section: "Security Digest"
date_published: 2026-08-17
date_modified: 2026-10-07
publisher: erroneo.us
author: erroneo.us Security Desk
license: All rights reserved. Quote with attribution and a link.
---

# Security digest: August 17, 2026

1 editorial brief, 1 known exploited (cisa kev) addition and 7 critical advisories.

## Take stock

- Check exposure: vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2 . Apps that use vm2 to run user-, tenant- or model-supplied JavaScript (plugin systems, rule and template engines, workflow and low-code tools, online code runners, AI agent code tools), directly or through a dependency.
- Do you run any of these? Ray-Project Ray. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-20.
- npm: 3 critical advisories ( vm2 ). Check with npm audit (or: npm ls <package>) .
- Go: 2 critical advisories ( github.com/QuantumNous/new-api ). Check with govulncheck ./... .
- PyPI: 1 critical advisory ( mlflow ). Check with pip-audit (or: pip show <package>) .
- GitHub Actions: 1 critical advisory ( wktk/conflibot ). Check with grep -rn 'uses: <owner>/<action>' .github/workflows .
- None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

## Editorial briefs

- **Check exposure** [vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2](https://erroneo.us/security/briefs/vm2-sandbox-escape-wave-3-12-2/index.md): If anything outside your trust boundary can get code into vm2, upgrade to 3.12.2 today and plan to move that code out of process; if vm2 only runs your own code, upgrade on a normal cycle.

## Known exploited (CISA KEV)

- [CVE-2025-62593](https://erroneo.us/security/cve/CVE-2025-62593/index.md) Ray-Project Ray: Ray-Project Ray Code Injection Vulnerability (CISA due 2026-08-20)

## Critical advisories

- [GHSA-m5w8-4gq2-6f8x](https://erroneo.us/security/ghsa/GHSA-m5w8-4gq2-6f8x/index.md) vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) — npm vm2 <= 3.11.5 → 3.11.6
- [CVE-2026-47686](https://erroneo.us/security/cve/CVE-2026-47686/index.md) VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE — npm vm2 <= 3.11.5 → 3.11.6
- [CVE-2026-47698](https://erroneo.us/security/cve/CVE-2026-47698/index.md) vm2: Sandbox Breakout Using Dangerous Host Proto Mutators — npm vm2 <= 3.11.5 → 3.11.6
- [CVE-2026-71479](https://erroneo.us/security/cve/CVE-2026-71479/index.md) New API: Integer overflow in quota billing yields negative charges (self-crediting) — Go github.com/QuantumNous/new-api <= 1.0.0-rc.17 → 1.0.0-rc.18
- [CVE-2026-64849](https://erroneo.us/security/cve/CVE-2026-64849/index.md) MLflow: Unauthenticated full-read SSRF in webhook delivery: _validate_webhook_url bypassed via unvalidated HTTP redirects (and DNS rebinding) — PyPI mlflow >= 3.3.0, < 3.15.0 → 3.15.0
- [CVE-2026-64859](https://erroneo.us/security/cve/CVE-2026-64859/index.md) New API: User List API Leaks Root User Access Token Leading to Privilege Escalation — Go github.com/QuantumNous/new-api < 1.0.0-rc.7 → 1.0.0-rc.7
- [CVE-2026-55158](https://erroneo.us/security/cve/CVE-2026-55158/index.md) conflibot vulnerable to command injection via crafted pull request branch names under pull_request_target — GitHub Actions wktk/conflibot < 1.2.1 → 1.2.1

---
Source page: https://erroneo.us/security/2026-08-17/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt