Login Request a demo
VM
Product
vm2
by patriksimek · last CVE Sep 27, 2026
69
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Vulnerabilities69In the news0Timeline
Severity mix
Critical 42High 16Medium 10Low 1
Severity
All severities69Critical42High16Medium10Low1
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add vm2 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-93606
10.0
1%
Sep 18
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species
Affected: before 3.12.1
CVE-2026-93605
10.0
1%
Sep 18
vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
Affected: before 3.12.1
CVE-2026-93603
10.0
1%
Sep 18
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
Affected: before 3.12.1
CVE-2026-92960
10.0
0%
Sep 17
vm2 before 3.11.6 Process-wide State Exposure via os and dns
Affected: before 3.11.6
CVE-2026-92956
10.0
1%
Sep 17
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
Affected: 3.10.1 before 3.11.7
CVE-2026-92955
10.0
1%
Sep 17
vm2 before 3.11.8 Sandbox Escape via NodeVM
Affected: before 3.11.8
CVE-2026-92953
10.0
1%
Sep 17
vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
Affected: 3.11.0 before 3.11.8
CVE-2026-92947
10.0
0%
Sep 17
vm2 before 3.11.7 Memory Disclosure via Buffer Pool
Affected: before 3.11.7
CVE-2026-92946
10.0
1%
Sep 17
vm2 before 3.11.7 Remote Code Execution via require.external
Affected: before 3.11.7
CVE-2026-92941
10.0
0%
Sep 17
vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
Affected: 3.11.3 before 3.11.7
CVE-2026-92940
10.0
0%
Sep 17
vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent
Affected: 3.11.3 before 3.11.7
CVE-2026-92937
10.0
1%
Sep 17
vm2 3.11.6 Remote Code Execution via Promise call/apply
Affected: 3.11.6 before 3.11.7
CVE-2026-47208
10.0
1%
Jun 12
vm2: Sandbox Breakout Using Promise Species
Affected: < 3.11.4
CVE-2026-47140
10.0
1%
Jun 12
vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
Affected: < 3.11.4
CVE-2026-47137
10.0
0%
Jun 12
vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE
Affected: < 3.11.4
CVE-2026-47131
10.0
1%
Jun 12
vm2: Sandbox Escape
Affected: < 3.11.4
CVE-2026-44005
10.0
1%
May 13
vm2: Sandbox escape
Affected: >= 3.9.6, < 3.11.0
CVE-2026-44006
10.0
1%
May 13
vm2: Sandbox Escape
Affected: < 3.11.0
CVE-2026-43997
10.0
1%
May 13
vm2: Sandbox Escape
Affected: < 3.11.0
CVE-2026-26332
10.0
1%
May 4
vm2: Sandbox Escape
Affected: < 3.11.0
CVE-2026-22709
10.0
1%
Jan 26
vm2 has a Sandbox Escape
Affected: < 3.10.2
CVE-2026-92957
9.9
1%
Sep 17
vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix
Affected: before 3.11.7
CVE-2026-92951
9.9
1%
Sep 17
vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
Affected: before 3.11.7
CVE-2026-92948
9.9
1%
Sep 17
vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
Affected: 3.9.6 before 3.11.7
CVE-2026-92939
9.9
1%
Sep 17
vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
Affected: 3.11.3 before 3.11.7
CVE-2026-92938
9.9
1%
Sep 17
vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
Affected: 3.11.3 before 3.11.7
CVE-2026-47686
9.9
1%
Aug 17
vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE
Affected: < 3.11.6
CVE-2026-43999
9.9
1%
May 13
vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape
Affected: < 3.11.0
CVE-2026-92944
9.8
1%
Sep 17
vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector
Affected: 3.10.2 before 3.11.7
CVE-2026-47698
9.8
1%
Aug 17
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
Affected: < 3.11.6
CVE-2026-47210
9.8
2%
Jun 12
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
Affected: < 3.11.4
CVE-2026-45411
9.8
1%
May 13
vm2: Sandbox Breakout Using Async Generator
Affected: < 3.11.3
CVE-2026-44009
9.8
1%
May 13
vm2: Sandbox Breakout Through Null Proto Exception
Affected: < 3.11.2
CVE-2026-44008
9.8
1%
May 13
vm2: Snabox breakout via `neutralizeArraySpeciesBatch`
Affected: < 3.11.2
CVE-2026-26956
9.8
1%
May 4
vm2: WASM Sandbox Escape (Node 25 only)
Affected: = 3.10.4
CVE-2026-24781
9.8
1%
May 4
vm2: Sandbox Breakout Through Inspect
Affected: < 3.11.0
CVE-2026-24120
9.8
1%
May 4
vm2: Sandbox Breakout Through Promise Species
Affected: < 3.10.5
CVE-2026-24118
9.8
1%
May 4
VM2 Sandbox Breakout Through __lookupGetter__
Affected: < 3.11.0
CVE-2026-44007
9.1
1%
May 13
vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution
Affected: < 3.11.1
CVE-2026-100721
9.0
1%
Sep 27
vm2 before 3.12.2 Authorization Bypass via Custom Resolver
Affected: before 3.12.2
CVE-2026-92935
9.0
1%
Sep 17
vm2 NodeVM Remote Code Execution via Array-Shaped Require
Affected: 3.11.4 before 3.11.7
CVE-2026-92934
9.0
1%
Sep 17
vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
Affected: before 3.11.8
CVE-2026-47683
8.7
1%
Aug 17
vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
Affected: < 3.11.6
CVE-2026-47135
8.7
0%
Jun 12
vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
Affected: < 3.11.4
CVE-2026-92954
8.6
0%
Sep 17
vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise
Affected: 3.10.0 before 3.11.8
CVE-2026-92950
8.6
0%
Sep 17
vm2 before 3.11.7 Sandbox Escape via CLI require
Affected: before 3.11.7
CVE-2026-47139
8.6
0%
Jun 12
vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server
Affected: < 3.11.4
CVE-2026-47209
8.6
0%
Jun 12
vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
Affected: < 3.11.4
CVE-2026-44001
8.6
0%
May 13
vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
Affected: < 3.11.0
CVE-2026-92958
8.5
0%
Sep 17
vm2 before 3.11.7 Denylist Bypass via fs/promises
Affected: before 3.11.7
Page 1 of 2 · 69 total
12