CriticalGHSA-6pw2-5hjv-9pf7CVE-2021-23555SNYK-JS-VM2-2309905

Sandbox bypass in vm2

Published 12 Feb 2022 · Updated 8 Jul 2026

Affected package

Affected: <3.9.6
Fixed in: 3.9.6

Update to the fixed version for your release line, for example:npm install vm2@3.9.6

Details

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

Is GHSA-6pw2-5hjv-9pf7 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected vm2, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisorynvd.nist.gov/vuln/detail/CVE-2021-23555
Linkgithub.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d
Packagegithub.com/patriksimek/vm2
Linksnyk.io/vuln/SNYK-JS-VM2-2309905

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.