Sign in
Deutsch English Español Polski
Critical

vm2 Sandbox Escape vulnerability

  • Disclosed: 12.04.2023
  • Updated: 11.10.2026 10:22

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context.

Impact

A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

Patches

This vulnerability was patched in the release of version 3.9.16 of vm2.

Workarounds

None.

References

Github Issue - https://github.com/patriksimek/vm2/issues/516 PoC - https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c

For more information

If you have any questions or comments about this advisory:

  • Open an issue in VM2

Thanks to Xion (SeungHyun Lee) of KAIST Hacking Lab for disclosing this vulnerability.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package vm2 < 3.9.16 3.9.16

References

CVSS score 9.8/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE)
CWE-913
Platform
npm
Package
vm2
Disclosed
12.04.2023
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-xj72-wvfv-8985 - CC BY 4.0

Vulnerability history: vm2

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (78) in the archive
Total entries
78
First → latest
10.2021 10.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 51
  • High 14
  • Medium 12
  • Low 1

Disclosures per year

Severity:
  1. vm2 contains a sandbox escape vulnerability
    Critical · 10.0 CVE-2026-93605 < 3.12.1 3.12.1
  2. vm2: NodeVM custom resolution bypasses external path boundaries
    Critical · 10.0 CVE-2026-100721 < 3.12.2 3.12.2
  3. vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
    High · 8.6 CVE-2026-100722 < 3.12.2 3.12.2
  4. vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
    High · 7.1 CVE-2026-92959 < 3.11.8 3.11.8
  5. vm2: Sandbox Escape (NodeVM)
    Critical · 10.0 CVE-2026-92955 < 3.11.8 3.11.8
  6. vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
    Critical · 8.6 CVE-2026-92954 >= 3.10.0, < 3.11.8 3.11.8
  7. vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
    Critical · 10.0 CVE-2026-92953 >= 3.11.0, < 3.11.8 3.11.8
  8. vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
    Critical · 9.0 CVE-2026-92934 < 3.11.8 3.11.8
  9. vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
    High · 7.5 CVE-2026-92942 < 3.11.7 3.11.7
  10. vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
    Critical · 10.0 CVE-2026-92946 < 3.11.7 3.11.7
  11. vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
    Critical · 10.0 CVE-2026-92947 < 3.11.7 3.11.7
  12. vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
    Critical · 10.0 CVE-2026-92956 >= 3.10.1, < 3.11.7 3.11.7
  13. vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
    Critical · 9.9 CVE-2026-92948 >= 3.9.6, < 3.11.7 3.11.7
  14. vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
    High · 8.6 CVE-2026-92950 < 3.11.7 3.11.7
  15. vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
    Critical · 10.0 CVE-2026-92940 >= 3.11.3, < 3.11.7 3.11.7
  16. vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
    Critical · 9.9 CVE-2026-92951 < 3.11.7 3.11.7
  17. vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
    High · 8.5 CVE-2026-92958 < 3.11.7 3.11.7
  18. vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
    Critical · 9.9 CVE-2026-92957 < 3.11.7 3.11.7
  19. vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
    Critical · 9.0 CVE-2026-92935 >= 3.11.4, < 3.11.7 3.11.7
  20. vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
    Critical · 10.0 CVE-2026-92937 >= 3.11.6, < 3.11.7 3.11.7
  21. vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
    Critical · 9.9 CVE-2026-92938 >= 3.11.3, < 3.11.7 3.11.7
  22. vm2 crypto builtin loads attacker native code through setEngine
    Critical · 9.9 CVE-2026-92939 >= 3.11.3, < 3.11.7 3.11.7
  23. vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
    Critical · 9.8 CVE-2026-92944 >= 3.10.2, < 3.11.7 3.11.7
  24. vm2 NodeVM can replace the host process TLS trust store
    Critical · 10.0 CVE-2026-92941 >= 3.11.3, < 3.11.7 3.11.7
  25. vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
    High · 7.5 CVE-2026-92961 < 3.11.6 3.11.6
  26. vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
    Critical · 10.0 CVE-2026-92960 < 3.11.6 3.11.6
  27. vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
    Critical · 9.8 CVE-2026-47698 < 3.11.6 3.11.6
  28. VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
    Critical · 9.9 CVE-2026-47686 < 3.11.6 3.11.6
  29. vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
    High CVE-2026-47683 < 3.11.6 3.11.6
  30. NodeVM network builtin exclusions bypass via internal _http_client and _http_server
    High · 8.6 CVE-2026-47139 < 3.11.4 3.11.4
  31. NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
    Critical · 10.0 CVE-2026-47140 < 3.11.4 3.11.4
  32. vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
    Critical · 9.8 CVE-2026-47210 < 3.11.4 3.11.4
  33. vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
    Critical · 10.0 CVE-2026-47137 < 3.11.4 3.11.4
  34. vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
    High · 8.6 CVE-2026-47209 < 3.11.4 3.11.4
  35. vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
    High · 8.7 CVE-2026-47135 < 3.11.4 3.11.4
  36. vm2 is Vulnerable to Sandbox Breakout Through Promise Species
    Critical · 10.0 CVE-2026-47208 < 3.11.4 3.11.4
  37. vm2 has a Sandbox Escape issue
    Critical · 10.0 CVE-2026-47131 < 3.11.4 3.11.4
  38. vm2 Has a Sandbox Breakout Using Async Generator
    Critical · 9.8 CVE-2026-45411 < 3.11.3 3.11.3
  39. vm2 has Sandbox Breakout Through Null Proto Exception
    Critical · 9.8 CVE-2026-44009 < 3.11.2 3.11.2
  40. vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
    Critical · 9.8 CVE-2026-44008 < 3.11.2 3.11.2
  41. vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
    Critical · 9.1 CVE-2026-44007 < 3.11.1 3.11.1
  42. vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
    High · 8.5 CVE-2026-43998 >= 3.10.5, < 3.11.0 3.11.0
  43. vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
    High · 7.5 CVE-2026-44004 < 3.11.0 3.11.0
  44. vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
    High · 8.6 CVE-2026-44001 < 3.11.0 3.11.0
  45. vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
    Critical · 9.9 CVE-2026-43999 >= 3.10.5, < 3.11.0 3.11.0
  46. vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
    Critical · 10.0 CVE-2026-44005 >= 3.9.6, < 3.11.0 3.11.0
  47. vm2 Access to Host Object Enables Sandbox Escape
    Critical · 10.0 CVE-2026-43997 < 3.11.0 3.11.0
  48. vm2 has a Sandbox Escape Vulnerability
    Critical · 10.0 CVE-2026-44006 < 3.11.0 3.11.0
  49. VM2 Has a WASM Sandbox Escape
    Critical · 9.8 CVE-2026-26956 < 3.10.5 3.10.5
  50. VM2 Has a Sandbox Escape Issue via SuppressedError
    Critical · 9.8 CVE-2026-26332 < 3.11.0 3.11.0
  51. VM2 Has Sandbox Breakout Through Inspect Function
    Critical · 9.8 CVE-2026-24781 < 3.11.0 3.11.0
  52. VM2 Has Sandbox Breakout Through Promise Species
    Critical · 9.8 CVE-2026-24120 < 3.10.5 3.10.5
  53. VM2 Sandbox Breakout Through __lookupGetter__
    Critical · 9.8 CVE-2026-24118 < 3.11.0 3.11.0
  54. vm2 has a Sandbox Escape
    Critical · 9.8 CVE-2026-22709 < 3.10.2 3.10.2
  55. vm2 Sandbox Escape vulnerability
    Critical · 9.8 CVE-2023-37466 < 3.10.0 3.10.0
  56. vm2 Sandbox Escape vulnerability
    Critical · 9.8 CVE-2023-37903 <= 3.9.19 no fix
  57. vm2 Sandbox Escape vulnerability
    Critical · 9.8 CVE-2023-32314 < 3.9.18 3.9.18
  58. vm2 Sandbox Escape vulnerability
    Critical · 9.8 CVE-2023-30547 < 3.9.17 3.9.17
  59. vm2 Sandbox Escape vulnerability this entry
    Critical · 9.8 CVE-2023-29199 < 3.9.16 3.9.16
  60. vm2 vulnerable to sandbox escape
    Critical · 9.8 CVE-2023-29017 < 3.9.15 3.9.15
  61. vm2 vulnerable to Arbitrary Code Execution
    Critical · 9.8 CVE-2022-25893 < 3.9.10 3.9.10
  62. vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host
    Critical · 10.0 CVE-2022-36067 < 3.9.11 3.9.11
  63. vm2 before 3.6.11 vulnerable to sandbox escape
    High · 8.3 CVE-2019-10761 < 3.6.11 3.6.11
  64. Sandbox bypass in vm2
    Critical · 9.8 CVE-2021-23555 < 3.9.6 3.9.6
  65. Prototype Pollution in vm2
    Critical · 9.8 CVE-2021-23449 < 3.9.4 3.9.4

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.