Vm2
Vm2 Project · 32 CVEs
vm2: Sandbox escape
May 13, 2026
vm2: Sandbox Breakout Using Async Generator
May 13, 2026
vm2: Sandbox Breakout Through Null Proto Exception
May 13, 2026
vm2: Snabox breakout via `neutralizeArraySpeciesBatch`
May 13, 2026
vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution
May 13, 2026
vm2: Sandbox Escape
May 13, 2026
vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)
May 13, 2026
vm2: Transformer Fast-Path Bypass Exposes Internal State Variable
May 13, 2026
vm2: Host File Path Disclosure via Stack Trace Information Leak
May 13, 2026
vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
May 13, 2026
vm2: sandbox boundary bypass via host Promise resolution preserving host object identity
May 13, 2026
vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape
May 13, 2026
vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
May 13, 2026
vm2: Sandbox Escape
May 13, 2026
vm2: WASM Sandbox Escape (Node 25 only)
May 4, 2026
vm2: Sandbox Escape
May 4, 2026
vm2: Sandbox Breakout Through Inspect
May 4, 2026
vm2: Sandbox Breakout Through Promise Species
May 4, 2026
VM2 Sandbox Breakout Through __lookupGetter__
May 4, 2026
vm2 has a Sandbox Escape
Jan 26, 2026
Sandbox Escape in vm2
Jul 21, 2023
vm2 Sandbox Escape vulnerability
Jul 13, 2023
Sandbox Escape
May 15, 2023
Inspect method manipulation in vm2
May 15, 2023
Sandbox Escape in vm2
Apr 17, 2023
| CVE ID | Description | Severity | EPSS | Published |
|---|---|---|---|---|
| CVE-2026-44005 | vm2: Sandbox escape | CRITICAL | 0.83% | May 13, 2026 |
| CVE-2026-45411 | vm2: Sandbox Breakout Using Async Generator | CRITICAL | 0.90% | May 13, 2026 |
| CVE-2026-44009 | vm2: Sandbox Breakout Through Null Proto Exception | CRITICAL | 0.71% | May 13, 2026 |
| CVE-2026-44008 | vm2: Snabox breakout via `neutralizeArraySpeciesBatch` | CRITICAL | 0.90% | May 13, 2026 |
| CVE-2026-44007 | vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution | CRITICAL | 0.61% | May 13, 2026 |
| CVE-2026-44006 | vm2: Sandbox Escape | CRITICAL | 0.77% | May 13, 2026 |
| CVE-2026-44004 | vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass) | HIGH | 0.66% | May 13, 2026 |
| CVE-2026-44003 | vm2: Transformer Fast-Path Bypass Exposes Internal State Variable | MEDIUM | 0.35% | May 13, 2026 |
| CVE-2026-44002 | vm2: Host File Path Disclosure via Stack Trace Information Leak | MEDIUM | 0.34% | May 13, 2026 |
| CVE-2026-44001 | vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) | HIGH | 0.66% | May 13, 2026 |
| CVE-2026-44000 | vm2: sandbox boundary bypass via host Promise resolution preserving host object identity | HIGH | 0.29% | May 13, 2026 |
| CVE-2026-43999 | vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape | CRITICAL | 0.97% | May 13, 2026 |
| CVE-2026-43998 | vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape | HIGH | 0.85% | May 13, 2026 |
| CVE-2026-43997 | vm2: Sandbox Escape | CRITICAL | 0.77% | May 13, 2026 |
| CVE-2026-26956 | vm2: WASM Sandbox Escape (Node 25 only) | CRITICAL | 0.92% | May 4, 2026 |
| CVE-2026-26332 | vm2: Sandbox Escape | CRITICAL | 0.74% | May 4, 2026 |
| CVE-2026-24781 | vm2: Sandbox Breakout Through Inspect | CRITICAL | 1.19% | May 4, 2026 |
| CVE-2026-24120 | vm2: Sandbox Breakout Through Promise Species | CRITICAL | 0.90% | May 4, 2026 |
| CVE-2026-24118 | VM2 Sandbox Breakout Through __lookupGetter__ | CRITICAL | 0.91% | May 4, 2026 |
| CVE-2026-22709 | vm2 has a Sandbox Escape | CRITICAL | 1.29% | Jan 26, 2026 |
| CVE-2023-37903 | Sandbox Escape in vm2 | CRITICAL | 4.21% | Jul 21, 2023 |
| CVE-2023-37466 | vm2 Sandbox Escape vulnerability | CRITICAL | 3.87% | Jul 13, 2023 |
| CVE-2023-32314 | Sandbox Escape | CRITICAL | 8.13% | May 15, 2023 |
| CVE-2023-32313 | Inspect method manipulation in vm2 | MEDIUM | 0.79% | May 15, 2023 |
| CVE-2023-30547 | Sandbox Escape in vm2 | CRITICAL | 72.09% | Apr 17, 2023 |
Showing 1 to 25 of 32 CVEs