VM
Product
vm2
69
CVEs
0
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 42High 16Medium 10Low 1
Watch
Add vm2 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-93606 | 10.0 | Sep 18 | vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species Affected: before 3.12.1 |
| CVE-2026-93605 | 10.0 | Sep 18 | vm2 NodeVM before 3.12.1 Remote Code Execution via child_process Affected: before 3.12.1 |
| CVE-2026-93603 | 10.0 | Sep 18 | vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function Affected: before 3.12.1 |
| CVE-2026-92960 | 10.0 | Sep 17 | vm2 before 3.11.6 Process-wide State Exposure via os and dns Affected: before 3.11.6 |
| CVE-2026-92956 | 10.0 | Sep 17 | vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming Affected: 3.10.1 before 3.11.7 |
| CVE-2026-92955 | 10.0 | Sep 17 | vm2 before 3.11.8 Sandbox Escape via NodeVM Affected: before 3.11.8 |
| CVE-2026-92953 | 10.0 | Sep 17 | vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray Affected: 3.11.0 before 3.11.8 |
| CVE-2026-92947 | 10.0 | Sep 17 | vm2 before 3.11.7 Memory Disclosure via Buffer Pool Affected: before 3.11.7 |
| CVE-2026-92946 | 10.0 | Sep 17 | vm2 before 3.11.7 Remote Code Execution via require.external Affected: before 3.11.7 |
| CVE-2026-92941 | 10.0 | Sep 17 | vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation Affected: 3.11.3 before 3.11.7 |
| CVE-2026-92940 | 10.0 | Sep 17 | vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent Affected: 3.11.3 before 3.11.7 |
| CVE-2026-92937 | 10.0 | Sep 17 | vm2 3.11.6 Remote Code Execution via Promise call/apply Affected: 3.11.6 before 3.11.7 |
| CVE-2026-47208 | 10.0 | Jun 12 | vm2: Sandbox Breakout Using Promise Species Affected: < 3.11.4 |
| CVE-2026-47140 | 10.0 | Jun 12 | vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution Affected: < 3.11.4 |
| CVE-2026-47137 | 10.0 | Jun 12 | vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE Affected: < 3.11.4 |
| CVE-2026-47131 | 10.0 | Jun 12 | vm2: Sandbox Escape Affected: < 3.11.4 |
| CVE-2026-44005 | 10.0 | May 13 | vm2: Sandbox escape Affected: >= 3.9.6, < 3.11.0 |
| CVE-2026-44006 | 10.0 | May 13 | vm2: Sandbox Escape Affected: < 3.11.0 |
| CVE-2026-43997 | 10.0 | May 13 | vm2: Sandbox Escape Affected: < 3.11.0 |
| CVE-2026-26332 | 10.0 | May 4 | vm2: Sandbox Escape Affected: < 3.11.0 |
| CVE-2026-22709 | 10.0 | Jan 26 | vm2 has a Sandbox Escape Affected: < 3.10.2 |
| CVE-2026-92957 | 9.9 | Sep 17 | vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix Affected: before 3.11.7 |
| CVE-2026-92951 | 9.9 | Sep 17 | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver Affected: before 3.11.7 |
| CVE-2026-92948 | 9.9 | Sep 17 | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test Affected: 3.9.6 before 3.11.7 |
| CVE-2026-92939 | 9.9 | Sep 17 | vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine Affected: 3.11.3 before 3.11.7 |
| CVE-2026-92938 | 9.9 | Sep 17 | vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite Affected: 3.11.3 before 3.11.7 |
| CVE-2026-47686 | 9.9 | Aug 17 | vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE Affected: < 3.11.6 |
| CVE-2026-43999 | 9.9 | May 13 | vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape Affected: < 3.11.0 |
| CVE-2026-92944 | 9.8 | Sep 17 | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector Affected: 3.10.2 before 3.11.7 |
| CVE-2026-47698 | 9.8 | Aug 17 | vm2: Sandbox Breakout Using Dangerous Host Proto Mutators Affected: < 3.11.6 |
| CVE-2026-47210 | 9.8 | Jun 12 | vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass Affected: < 3.11.4 |
| CVE-2026-45411 | 9.8 | May 13 | vm2: Sandbox Breakout Using Async Generator Affected: < 3.11.3 |
| CVE-2026-44009 | 9.8 | May 13 | vm2: Sandbox Breakout Through Null Proto Exception Affected: < 3.11.2 |
| CVE-2026-44008 | 9.8 | May 13 | vm2: Snabox breakout via `neutralizeArraySpeciesBatch` Affected: < 3.11.2 |
| CVE-2026-26956 | 9.8 | May 4 | vm2: WASM Sandbox Escape (Node 25 only) Affected: = 3.10.4 |
| CVE-2026-24781 | 9.8 | May 4 | vm2: Sandbox Breakout Through Inspect Affected: < 3.11.0 |
| CVE-2026-24120 | 9.8 | May 4 | vm2: Sandbox Breakout Through Promise Species Affected: < 3.10.5 |
| CVE-2026-24118 | 9.8 | May 4 | VM2 Sandbox Breakout Through __lookupGetter__ Affected: < 3.11.0 |
| CVE-2026-44007 | 9.1 | May 13 | vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution Affected: < 3.11.1 |
| CVE-2026-100721 | 9.0 | Sep 27 | vm2 before 3.12.2 Authorization Bypass via Custom Resolver Affected: before 3.12.2 |
| CVE-2026-92935 | 9.0 | Sep 17 | vm2 NodeVM Remote Code Execution via Array-Shaped Require Affected: 3.11.4 before 3.11.7 |
| CVE-2026-92934 | 9.0 | Sep 17 | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError Affected: before 3.11.8 |
Showing 42