vm2 vulnerabilities
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
- Registry
- npm
- Latest
- 3.12.2
- License
- MIT
78 known advisories
The latest version, 3.12.2, is not affected by any of them. Projects on older versions may be.
npm install vm2@3.12.2Security advisories for vm2
vm2 contains a sandbox escape vulnerability
- Affected
- <3.12.1
- Fixed in
- 3.12.1
vm2: NodeVM custom resolution bypasses external path boundaries
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: Sandbox Escape (NodeVM)
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
- Affected
- >=3.10.0 <3.11.8
- Fixed in
- 3.11.8
vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
- Affected
- >=3.11.0 <3.11.8
- Fixed in
- 3.11.8
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
- Affected
- >=3.11.0 <3.11.7
- Fixed in
- 3.11.7
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
- Affected
- >=3.10.1 <3.11.7
- Fixed in
- 3.11.7
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
- Affected
- >=3.11.4 <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
- Affected
- >=3.9.6 <3.11.7
- Fixed in
- 3.11.7
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
- Affected
- >=3.9.6 <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
- Affected
- >=3.11.4 <3.11.7
- Fixed in
- 3.11.7
vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
- Affected
- >=3.11.6 <3.11.7
- Fixed in
- 3.11.7
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2 crypto builtin loads attacker native code through setEngine
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
- Affected
- >=3.10.2 <3.11.7
- Fixed in
- 3.11.7
vm2 NodeVM can replace the host process TLS trust store
- Affected
- >=3.11.3 <3.11.7
- Fixed in
- 3.11.7
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
- Affected
- <3.11.6
- Fixed in
- 3.11.6
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
- Affected
- <3.11.6
- Fixed in
- 3.11.6
NodeVM observability builtins leak host process and HTTP request data
- Affected
- <3.11.4
- Fixed in
- 3.11.4
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
- Affected
- <3.11.4
- Fixed in
- 3.11.4
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a Sandbox Escape issue
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 Has a Sandbox Breakout Using Async Generator
- Affected
- <3.11.3
- Fixed in
- 3.11.3
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 has Sandbox Breakout Through Null Proto Exception
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
- Affected
- <3.11.1
- Fixed in
- 3.11.1
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
- Affected
- >=3.10.5 <3.11.0
- Fixed in
- 3.11.0
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
- Affected
- >=3.10.5 <3.11.0
- Fixed in
- 3.11.0
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
- Affected
- >=3.9.6 <3.11.0
- Fixed in
- 3.11.0
vm2 Access to Host Object Enables Sandbox Escape
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 has a Sandbox Escape Vulnerability
- Affected
- <3.11.0
- Fixed in
- 3.11.0
VM2 Has a WASM Sandbox Escape
- Affected
- <3.10.5
- Fixed in
- 3.10.5
VM2 Has a Sandbox Escape Issue via SuppressedError
- Affected
- <3.11.0
- Fixed in
- 3.11.0
VM2 Has Sandbox Breakout Through Inspect Function
- Affected
- <3.11.0
- Fixed in
- 3.11.0
VM2 Has Sandbox Breakout Through Promise Species
- Affected
- <3.10.5
- Fixed in
- 3.10.5
VM2 Sandbox Breakout Through __lookupGetter__
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 has a Sandbox Escape
- Affected
- <3.10.2
- Fixed in
- 3.10.2
vm2 Sandbox Escape vulnerability
- Affected
- <3.10.0
- Fixed in
- 3.10.0
vm2 Sandbox Escape vulnerability
- Affected
- <=3.9.19
- Fixed in
- No fix released
vm2 vulnerable to Inspect Manipulation
- Affected
- <3.9.18
- Fixed in
- 3.9.18
vm2 Sandbox Escape vulnerability
- Affected
- <3.9.18
- Fixed in
- 3.9.18
vm2 Sandbox Escape vulnerability
- Affected
- <3.9.17
- Fixed in
- 3.9.17
vm2 Sandbox Escape vulnerability
- Affected
- <3.9.16
- Fixed in
- 3.9.16
vm2 vulnerable to sandbox escape
- Affected
- <3.9.15
- Fixed in
- 3.9.15
vm2 vulnerable to Arbitrary Code Execution
- Affected
- <3.9.10
- Fixed in
- 3.9.10
vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host
- Affected
- <3.9.11
- Fixed in
- 3.9.11
vm2 before 3.6.11 vulnerable to sandbox escape
- Affected
- <3.6.11
- Fixed in
- 3.6.11
Sandbox bypass in vm2
- Affected
- <3.9.6
- Fixed in
- 3.9.6
Prototype Pollution in vm2
- Affected
- <3.9.4
- Fixed in
- 3.9.4
Which of your client projects still run an old vm2?
NPMscan reads the package-lock.json, yarn.lock and pnpm-lock.yaml in every GitHub repo you pick and checks each installed version against these advisories, including the packages your packages pull in. Each finding comes with the command that fixes it.
Other npm packages
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily. Package details from the npm registry.