Vm2
Patriksimek · 77 CVEs
vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool
Sep 27, 2026
vm2 before 3.12.2 Host Process Termination via Construct Trap
Sep 27, 2026
vm2 before 3.12.2 Authorization Bypass via Custom Resolver
Sep 27, 2026
vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species
Sep 18, 2026
vm2 NodeVM before 3.12.1 Remote Code Execution via child_process
Sep 18, 2026
vm2 3.11.8 Sandbox Escape via crypto.setFips
Sep 18, 2026
vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function
Sep 18, 2026
vm2 before 3.11.2 Information Disclosure via Internal State
Sep 17, 2026
vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js
Sep 17, 2026
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass
Sep 17, 2026
vm2 before 3.11.6 Process-wide State Exposure via os and dns
Sep 17, 2026
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
Sep 17, 2026
vm2 before 3.11.7 Denylist Bypass via fs/promises
Sep 17, 2026
vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix
Sep 17, 2026
vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming
Sep 17, 2026
vm2 before 3.11.8 Sandbox Escape via NodeVM
Sep 17, 2026
vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise
Sep 17, 2026
vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
Sep 17, 2026
vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass
Sep 17, 2026
vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
Sep 17, 2026
vm2 before 3.11.7 Sandbox Escape via CLI require
Sep 17, 2026
vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor
Sep 17, 2026
vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test
Sep 17, 2026
vm2 before 3.11.7 Memory Disclosure via Buffer Pool
Sep 17, 2026
vm2 before 3.11.7 Remote Code Execution via require.external
Sep 17, 2026
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-100723 | vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool | MEDIUM | 0.32% | Sep 27, 2026 |
| CVE-2026-100722 | vm2 before 3.12.2 Host Process Termination via Construct Trap | HIGH | 0.26% | Sep 27, 2026 |
| CVE-2026-100721 | vm2 before 3.12.2 Authorization Bypass via Custom Resolver | CRITICAL | 0.40% | Sep 27, 2026 |
| CVE-2026-93606 | vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species | CRITICAL | 0.71% | Sep 18, 2026 |
| CVE-2026-93605 | vm2 NodeVM before 3.12.1 Remote Code Execution via child_process | CRITICAL | 0.73% | Sep 18, 2026 |
| CVE-2026-93604 | vm2 3.11.8 Sandbox Escape via crypto.setFips | MEDIUM | 0.34% | Sep 18, 2026 |
| CVE-2026-93603 | vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function | CRITICAL | 0.73% | Sep 18, 2026 |
| CVE-2026-92963 | vm2 before 3.11.2 Information Disclosure via Internal State | MEDIUM | 0.34% | Sep 17, 2026 |
| CVE-2026-92962 | vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js | LOW | 0.15% | Sep 17, 2026 |
| CVE-2026-92961 | vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass | HIGH | 0.53% | Sep 17, 2026 |
| CVE-2026-92960 | vm2 before 3.11.6 Process-wide State Exposure via os and dns | CRITICAL | 0.47% | Sep 17, 2026 |
| CVE-2026-92959 | vm2 before 3.11.8 allowAsync Bypass via Promise Thenable | HIGH | 0.45% | Sep 17, 2026 |
| CVE-2026-92958 | vm2 before 3.11.7 Denylist Bypass via fs/promises | HIGH | 0.38% | Sep 17, 2026 |
| CVE-2026-92957 | vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix | CRITICAL | 0.54% | Sep 17, 2026 |
| CVE-2026-92956 | vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming | CRITICAL | 0.59% | Sep 17, 2026 |
| CVE-2026-92955 | vm2 before 3.11.8 Sandbox Escape via NodeVM | CRITICAL | 0.71% | Sep 17, 2026 |
| CVE-2026-92954 | vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise | CRITICAL | 0.49% | Sep 17, 2026 |
| CVE-2026-92953 | vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray | CRITICAL | 0.50% | Sep 17, 2026 |
| CVE-2026-92952 | vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass | HIGH | 0.46% | Sep 17, 2026 |
| CVE-2026-92951 | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver | CRITICAL | 0.54% | Sep 17, 2026 |
| CVE-2026-92950 | vm2 before 3.11.7 Sandbox Escape via CLI require | CRITICAL | 0.20% | Sep 17, 2026 |
| CVE-2026-92949 | vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor | MEDIUM | 0.32% | Sep 17, 2026 |
| CVE-2026-92948 | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test | CRITICAL | 0.65% | Sep 17, 2026 |
| CVE-2026-92947 | vm2 before 3.11.7 Memory Disclosure via Buffer Pool | CRITICAL | 0.48% | Sep 17, 2026 |
| CVE-2026-92946 | vm2 before 3.11.7 Remote Code Execution via require.external | CRITICAL | 0.86% | Sep 17, 2026 |
Showing 1 to 25 of 77 CVEs