Is vm2 3.10 vulnerable?
npm · 6 releases from 3.10.0 to 3.10.5 · latest vm2 is 3.12.2 · checked 2 Nov 2026
Yes: 54 known advisories
Yes. vm2 3.10.5, the last 3.10 release, is affected by 54 known security advisories (31 critical, 13 high, 9 medium, 1 low), including CVE-2026-93605, CVE-2026-100721, CVE-2026-92955. 3 more affect earlier 3.10.x releases. Upgrade to 3.12.2 or later to fix all of them.
npm install vm2@3.12.2Advisories affecting vm2 3.10.5
vm2 contains a sandbox escape vulnerability
- Affected
- <3.12.1
- Fixed in
- 3.12.1
vm2: NodeVM custom resolution bypasses external path boundaries
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
- Affected
- <3.12.2
- Fixed in
- 3.12.2
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: Sandbox Escape (NodeVM)
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
- Affected
- >=3.10.0 <3.11.8
- Fixed in
- 3.11.8
vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack
- Affected
- <3.11.8
- Fixed in
- 3.11.8
vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
- Affected
- >=3.10.1 <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
- Affected
- >=3.9.6 <3.11.7
- Fixed in
- 3.11.7
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
- Affected
- >=3.9.6 <3.11.7
- Fixed in
- 3.11.7
vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
- Affected
- >=3.10.2 <3.11.7
- Fixed in
- 3.11.7
vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted
- Affected
- <3.11.7
- Fixed in
- 3.11.7
vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
- Affected
- <3.11.6
- Fixed in
- 3.11.6
VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
- Affected
- <3.11.6
- Fixed in
- 3.11.6
vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
- Affected
- <3.11.6
- Fixed in
- 3.11.6
NodeVM observability builtins leak host process and HTTP request data
- Affected
- <3.11.4
- Fixed in
- 3.11.4
NodeVM network builtin exclusions bypass via internal _http_client and _http_server
- Affected
- <3.11.4
- Fixed in
- 3.11.4
NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 is Vulnerable to Sandbox Breakout Through Promise Species
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 has a Sandbox Escape issue
- Affected
- <3.11.4
- Fixed in
- 3.11.4
vm2 Has a Sandbox Breakout Using Async Generator
- Affected
- <3.11.3
- Fixed in
- 3.11.3
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 has Sandbox Breakout Through Null Proto Exception
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
- Affected
- <3.11.2
- Fixed in
- 3.11.2
vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution
- Affected
- <3.11.1
- Fixed in
- 3.11.1
vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape
- Affected
- >=3.10.5 <3.11.0
- Fixed in
- 3.11.0
vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape
- Affected
- >=3.10.5 <3.11.0
- Fixed in
- 3.11.0
vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape
- Affected
- >=3.9.6 <3.11.0
- Fixed in
- 3.11.0
vm2 Access to Host Object Enables Sandbox Escape
- Affected
- <3.11.0
- Fixed in
- 3.11.0
vm2 has a Sandbox Escape Vulnerability
- Affected
- <3.11.0
- Fixed in
- 3.11.0
VM2 Has a Sandbox Escape Issue via SuppressedError
- Affected
- <3.11.0
- Fixed in
- 3.11.0
VM2 Has Sandbox Breakout Through Inspect Function
- Affected
- <3.11.0
- Fixed in
- 3.11.0
VM2 Sandbox Breakout Through __lookupGetter__
- Affected
- <3.11.0
- Fixed in
- 3.11.0
Fixed within 3.10.x, affecting earlier releases
VM2 Has a WASM Sandbox Escape
- Affected
- <3.10.5
- Fixed in
- 3.10.5
VM2 Has Sandbox Breakout Through Promise Species
- Affected
- <3.10.5
- Fixed in
- 3.10.5
vm2 has a Sandbox Escape
- Affected
- <3.10.2
- Fixed in
- 3.10.2
Which of your client projects are still on vm2 3.10?
NPMscan reads the lockfiles in every GitHub repo you pick, finds the exact vm2 version each one installs, and checks it against these advisories. Each finding comes with the command that fixes it.
Other vm2 versions
Advisory data from OSV.dev (opens OSV.dev in a new tab), which includes the GitHub Advisory Database. Release list from the npm registry. Refreshed daily.