vm2 project records

32 published records for vendor vm2 project.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 22
With a fix record: 96.9%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

32 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
62This week	CVE-2023-30547Proof of concept	Sandbox Escape in vm2vm2 project · vm2 · CWE-74 pre-auth RCE	Critical10.0	—	72.9%	Apr 17, 2023
58Plan	CVE-2023-29017Proof of concept	vm2 Sandbox Escape vulnerabilityvm2 project · vm2 · CWE-913 pre-auth RCE	Critical9.8	—	63.1%	Apr 6, 2023
54Plan	CVE-2022-36067Proof of concept	vm2 vulnerable to Sandbox Escape before v3.9.11vm2 project · vm2 · CWE-913 pre-auth RCE	Critical10.0	—	47.8%	Sep 6, 2022
42Plan	CVE-2023-32314Proof of concept	vm2 is a sandbox that can run untrusted code with Node's built-in modules.vm2 project · vm2 · CWE-74 pre-auth RCE	Critical10.0	—	8.1%	May 15, 2023
41Plan	CVE-2023-37903Proof of concept	Sandbox Escape in vm2vm2 project · vm2 · CWE-78 pre-auth RCE Command injection	Critical10.0	—	4.2%	Jul 21, 2023
41Plan	CVE-2023-37466No exploit	vm2 Sandbox Escape vulnerabilityvm2 project · vm2 · CWE-94 pre-auth RCE	Critical10.0	—	3.8%	Jul 13, 2023
41Plan	CVE-2023-29199No exploit	vm2 Sandbox escape vulnerabilityvm2 project · vm2 · CWE-913 pre-auth RCE	Critical10.0	—	3.8%	Apr 14, 2023
41Plan	CVE-2021-23449No exploit	This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the hostvm2 project · vm2 · CWE-1321 pre-auth RCE Prototype pollution	Critical10.0	—	3.5%	Oct 18, 2021
40Plan	CVE-2021-23555No exploit	The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during genvm2 project · vm2 pre-auth RCE	Critical9.8	—	2.8%	Feb 11, 2022
40Plan	CVE-2026-22709No exploit	vm2 has a Sandbox Escapevm2 project · vm2 · CWE-94 pre-auth RCE	Critical10.0	—	1.2%	Jan 26, 2026
40Plan	CVE-2026-43997No exploit	vm2 is an open source vm/sandbox for Node.js.vm2 project · vm2 · CWE-94 pre-auth RCE	Critical10.0	—	0.9%	May 13, 2026
40Plan	CVE-2026-44005No exploit	vm2 is an open source vm/sandbox for Node.js.vm2 project · vm2 · CWE-94 pre-auth RCE	Critical10.0	—	0.8%	May 13, 2026
40Plan	CVE-2026-44006No exploit	vm2 is an open source vm/sandbox for Node.js.vm2 project · vm2 · CWE-94 pre-auth RCE	Critical10.0	—	0.8%	May 13, 2026
40Plan	CVE-2026-26332No exploit	vm2 is an open source vm/sandbox for Node.js.vm2 project · vm2 · CWE-94 pre-auth RCE	Critical10.0	—	0.7%	May 4, 2026
39Monitor	CVE-2022-25893No exploit	Arbitrary Code Executionvm2 project · vm2 · CWE-471 pre-auth RCE	Critical9.8	—	1.5%	Dec 21, 2022
39Monitor	CVE-2026-24781No exploit	vm2: Sandbox Breakout Through Inspectvm2 project · vm2 · CWE-94 pre-auth RCE	Critical9.8	—	1.1%	May 4, 2026
39Monitor	CVE-2026-26956No exploit	vm2: WASM Sandbox Escape (Node 25 only)vm2 project · vm2 · CWE-693 pre-auth RCE	Critical9.8	—	1.0%	May 4, 2026
39Monitor	CVE-2026-43999No exploit	vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escapevm2 project · vm2 · CWE-863 RCE Broken access control (IDOR)	Critical9.9	—	0.9%	May 13, 2026
39Monitor	CVE-2026-24118Proof of concept	VM2 Sandbox Breakout Through __lookupGetter__vm2 project · vm2 · CWE-94 pre-auth RCE	Critical9.8	—	0.9%	May 4, 2026
39Monitor	CVE-2026-24120No exploit	vm2: Sandbox Breakout Through Promise Speciesvm2 project · vm2 · CWE-94 pre-auth RCE	Critical9.8	—	0.8%	May 4, 2026
39Monitor	CVE-2026-44008No exploit	vm2: Snabox breakout via `neutralizeArraySpeciesBatch`vm2 project · vm2 · CWE-668 pre-auth RCE	Critical9.8	—	0.8%	May 13, 2026
39Monitor	CVE-2026-44009No exploit	vm2: Sandbox Breakout Through Null Proto Exceptionvm2 project · vm2 · CWE-668 Pre-auth	Critical9.8	—	0.8%	May 13, 2026
39Monitor	CVE-2026-45411No exploit	vm2: Sandbox Breakout Using Async Generatorvm2 project · vm2 · CWE-668 pre-auth RCE	Critical9.8	—	0.5%	May 13, 2026
36Monitor	CVE-2026-44007No exploit	vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command executionvm2 project · vm2 · CWE-284 RCE Broken access control (IDOR)	Critical9.1	—	0.9%	May 13, 2026
34Monitor	CVE-2026-43998No exploit	vm2: NodeVM require.root bypass via symlink traversal allows sandbox escapevm2 project · vm2 · CWE-59 RCE	High8.5	—	0.7%	May 13, 2026

CVE-2023-30547
62This week
Sandbox Escape in vm2
CriticalCVSS 10.0Proof of conceptEPSS 72%
- pre-auth RCE
vm2 project · vm2Apr 17, 2023
CVE-2023-29017
58Plan
vm2 Sandbox Escape vulnerability
CriticalCVSS 9.8Proof of conceptEPSS 63%
- pre-auth RCE
vm2 project · vm2Apr 6, 2023
CVE-2022-36067
54Plan
vm2 vulnerable to Sandbox Escape before v3.9.11
CriticalCVSS 10.0Proof of conceptEPSS 47%
- pre-auth RCE
vm2 project · vm2Sep 6, 2022
CVE-2023-32314
42Plan
vm2 is a sandbox that can run untrusted code with Node's built-in modules.
CriticalCVSS 10.0Proof of conceptEPSS 8%
- pre-auth RCE
vm2 project · vm2May 15, 2023
CVE-2023-37903
41Plan
Sandbox Escape in vm2
CriticalCVSS 10.0Proof of conceptEPSS 4%
- pre-auth RCE
- Command injection
vm2 project · vm2Jul 21, 2023
CVE-2023-37466
41Plan
vm2 Sandbox Escape vulnerability
CriticalCVSS 10.0No exploitEPSS 3%
- pre-auth RCE
vm2 project · vm2Jul 13, 2023
CVE-2023-29199
41Plan
vm2 Sandbox escape vulnerability
CriticalCVSS 10.0No exploitEPSS 3%
- pre-auth RCE
vm2 project · vm2Apr 14, 2023
CVE-2021-23449
41Plan
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host
CriticalCVSS 10.0No exploitEPSS 3%
- pre-auth RCE
- Prototype pollution
vm2 project · vm2Oct 18, 2021
CVE-2021-23555
40Plan
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during gen
CriticalCVSS 9.8No exploitEPSS 2%
- pre-auth RCE
vm2 project · vm2Feb 11, 2022
CVE-2026-22709
40Plan
vm2 has a Sandbox Escape
CriticalCVSS 10.0No exploitEPSS 1%
- pre-auth RCE
vm2 project · vm2Jan 26, 2026
CVE-2026-43997
40Plan
vm2 is an open source vm/sandbox for Node.js.
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
vm2 project · vm2May 13, 2026
CVE-2026-44005
40Plan
vm2 is an open source vm/sandbox for Node.js.
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
vm2 project · vm2May 13, 2026
CVE-2026-44006
40Plan
vm2 is an open source vm/sandbox for Node.js.
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
vm2 project · vm2May 13, 2026
CVE-2026-26332
40Plan
vm2 is an open source vm/sandbox for Node.js.
CriticalCVSS 10.0No exploitEPSS 0%
- pre-auth RCE
vm2 project · vm2May 4, 2026
CVE-2022-25893
39Monitor
Arbitrary Code Execution
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
vm2 project · vm2Dec 21, 2022
CVE-2026-24781
39Monitor
vm2: Sandbox Breakout Through Inspect
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
vm2 project · vm2May 4, 2026
CVE-2026-26956
39Monitor
vm2: WASM Sandbox Escape (Node 25 only)
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
vm2 project · vm2May 4, 2026
CVE-2026-43999
39Monitor
vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape
CriticalCVSS 9.9No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
vm2 project · vm2May 13, 2026
CVE-2026-24118
39Monitor
VM2 Sandbox Breakout Through __lookupGetter__
CriticalCVSS 9.8Proof of conceptEPSS 0%
- pre-auth RCE
vm2 project · vm2May 4, 2026
CVE-2026-24120
39Monitor
vm2: Sandbox Breakout Through Promise Species
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
vm2 project · vm2May 4, 2026
CVE-2026-44008
39Monitor
vm2: Snabox breakout via `neutralizeArraySpeciesBatch`
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
vm2 project · vm2May 13, 2026
CVE-2026-44009
39Monitor
vm2: Sandbox Breakout Through Null Proto Exception
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
vm2 project · vm2May 13, 2026
CVE-2026-45411
39Monitor
vm2: Sandbox Breakout Using Async Generator
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
vm2 project · vm2May 13, 2026
CVE-2026-44007
36Monitor
vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution
CriticalCVSS 9.1No exploitEPSS 0%
- RCE
- Broken access control (IDOR)
vm2 project · vm2May 13, 2026
CVE-2026-43998
34Monitor
vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape
HighCVSS 8.5No exploitEPSS 0%
- RCE
vm2 project · vm2May 13, 2026