Skip to content
OpenAdvisories

Package · npm

vm2

78 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

50 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-37903 Public exploit

    Sandbox Escape in vm2

    vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has ar…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-37466

    vm2 Sandbox Escape vulnerability

    vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypas…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-32314 Public exploit

    Sandbox Escape

    vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a resu…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-30547 Public exploit EPSS 73%

    Sandbox Escape in vm2

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2023-29199

    vm2 Sandbox escape vulnerability

    There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbi…

    patriksimek vm2 vm2 npm
  • Critical 10.0
    CVE-2023-29017 Public exploit EPSS 63%

    vm2 Sandbox Escape vulnerability

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the s…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2022-25893

    Arbitrary Code Execution

    The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

    vm2 npm
  • Critical 10.0
    CVE-2022-36067 Public exploit EPSS 48%

    vm2 vulnerable to Sandbox Escape before v3.9.11

    vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerabil…

    patriksimek vm2 vm2 npm
  • Critical 9.8
    CVE-2021-23555

    Sandbox Bypass

    The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

    vm2 npm
  • Critical 9.8
    CVE-2021-23449

    Sandbox Bypass

    This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.

    vm2 npm