Sign in
Deutsch English Español Polski
Critical

vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host

  • Disclosed: 28.09.2022
  • Updated: 11.10.2026 10:22

Impact

A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

Patches

This vulnerability was patched in the release of version 3.9.11 of vm2

Workarounds

None.

References

Github Issue - https://github.com/patriksimek/vm2/issues/467 The file that was patched - https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71 The commit with the patch - https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164

For more information

If you have any questions or comments about this advisory:

  • Open an issue in VM2

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package vm2 < 3.9.11 3.9.11

References

CVSS score 10/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Weakness (CWE)
CWE-913
Platform
npm
Package
vm2
Disclosed
28.09.2022
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-mrgp-mrhc-5jrq - CC BY 4.0

Vulnerability history: vm2

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (78) in the archive
Total entries
78
First → latest
10.2021 10.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 51
  • High 14
  • Medium 12
  • Low 1

Disclosures per year

Severity:
  1. vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host this entry
    Critical · 10.0 CVE-2022-36067 < 3.9.11 3.9.11
  2. vm2 contains a sandbox escape vulnerability
    Critical · 10.0 CVE-2026-93605 < 3.12.1 3.12.1
  3. vm2: NodeVM custom resolution bypasses external path boundaries
    Critical · 10.0 CVE-2026-100721 < 3.12.2 3.12.2
  4. vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
    High · 8.6 CVE-2026-100722 < 3.12.2 3.12.2
  5. vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
    High · 7.1 CVE-2026-92959 < 3.11.8 3.11.8
  6. vm2: Sandbox Escape (NodeVM)
    Critical · 10.0 CVE-2026-92955 < 3.11.8 3.11.8
  7. vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
    Critical · 8.6 CVE-2026-92954 >= 3.10.0, < 3.11.8 3.11.8
  8. vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
    Critical · 10.0 CVE-2026-92953 >= 3.11.0, < 3.11.8 3.11.8
  9. vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
    Critical · 9.0 CVE-2026-92934 < 3.11.8 3.11.8
  10. vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
    High · 7.5 CVE-2026-92942 < 3.11.7 3.11.7
  11. vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
    Critical · 10.0 CVE-2026-92946 < 3.11.7 3.11.7
  12. vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
    Critical · 10.0 CVE-2026-92947 < 3.11.7 3.11.7
  13. vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
    Critical · 10.0 CVE-2026-92956 >= 3.10.1, < 3.11.7 3.11.7
  14. vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
    Critical · 9.9 CVE-2026-92948 >= 3.9.6, < 3.11.7 3.11.7
  15. vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
    High · 8.6 CVE-2026-92950 < 3.11.7 3.11.7
  16. vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
    Critical · 10.0 CVE-2026-92940 >= 3.11.3, < 3.11.7 3.11.7
  17. vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
    Critical · 9.9 CVE-2026-92951 < 3.11.7 3.11.7
  18. vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
    High · 8.5 CVE-2026-92958 < 3.11.7 3.11.7
  19. vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
    Critical · 9.9 CVE-2026-92957 < 3.11.7 3.11.7
  20. vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
    Critical · 9.0 CVE-2026-92935 >= 3.11.4, < 3.11.7 3.11.7
  21. vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
    Critical · 10.0 CVE-2026-92937 >= 3.11.6, < 3.11.7 3.11.7
Show more (20) Showing 21 of 65

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.