Skip to main content
cve.nowby Sazabi
← npm
npmPackage

vm2

78 known vulnerabilities (52 critical, 14 high, 10 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
3.12.2 (Sep 8, 2026): no advisory affects it
Newest unaffected release
3.12.2 (Sep 8, 2026), the latest release
Advisories
78 · 52 critical, 14 high, 10 medium, 2 low
Weekly downloads
1.3M
Dependents
4,327
Releases
83 since 0.1.0 (Jan 14, 2014)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Show all 78 advisoriesShow fewer advisories
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 78

  • CVE-2026-100723Medium 6.9

    vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

    Affected: fixed in 3.12.2.

    Fixed in 3.12.2 (released Sep 8, 2026, 19 days before disclosure).

    The latest release, 3.12.2, is not affected.

    73% of vm2 downloads last week were affected versions (1.1M).

  • vm2 before 3.12.2 Host Process Termination via Construct Trap

    Affected: fixed in 3.12.2.

    Fixed in 3.12.2 (released Sep 8, 2026, 19 days before disclosure).

    The latest release, 3.12.2, is not affected.

    73% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-100721Critical 9.5

    vm2 before 3.12.2 Authorization Bypass via Custom Resolver

    Affected: fixed in 3.12.2.

    Fixed in 3.12.2 (released Sep 8, 2026, 19 days before disclosure).

    The latest release, 3.12.2, is not affected.

    73% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-93605Critical 10.0

    vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

    Affected: fixed in 3.12.1.

    Fixed in 3.12.1 (released Sep 3, 2026, 15 days before disclosure).

    The latest release, 3.12.2, is not affected.

    73% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92963Medium 6.9

    vm2 before 3.11.2 Information Disclosure via Internal State

    Affected: fixed in 3.11.2.

    Fixed in 3.11.2 (released May 3, 2026, 137 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (947.4K).

  • vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 122 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass

    Affected: fixed in 3.11.6.

    Fixed in 3.11.6 (released Aug 14, 2026, 34 days before disclosure).

    The latest release, 3.12.2, is not affected.

    68% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92960Critical 10.0

    vm2 before 3.11.6 Process-wide State Exposure via os and dns

    Affected: fixed in 3.11.6.

    Fixed in 3.11.6 (released Aug 14, 2026, 34 days before disclosure).

    The latest release, 3.12.2, is not affected.

    68% of vm2 downloads last week were affected versions (1.1M).

  • vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

    Affected: fixed in 3.11.8.

    Fixed in 3.11.8 (released Aug 27, 2026, 21 days before disclosure).

    The latest release, 3.12.2, is not affected.

    71% of vm2 downloads last week were affected versions (1.1M).

  • vm2 before 3.11.7 Denylist Bypass via fs/promises

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92957Critical 9.4

    vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92956Critical 10.0

    vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming

    Affected: from 3.10.1, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    17% of vm2 downloads last week were affected versions (263.7K).

  • CVE-2026-92955Critical 10.0

    vm2 before 3.11.8 Sandbox Escape via NodeVM

    Affected: fixed in 3.11.8.

    Fixed in 3.11.8 (released Aug 27, 2026, 21 days before disclosure).

    The latest release, 3.12.2, is not affected.

    71% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92954Critical 9.2

    vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise

    Affected: from 3.10.0, fixed in 3.11.8.

    Fixed in 3.11.8 (released Aug 27, 2026, 21 days before disclosure).

    The latest release, 3.12.2, is not affected.

    24% of vm2 downloads last week were affected versions (380.9K).

  • CVE-2026-92953Critical 9.3

    vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

    Affected: from 3.11.0, fixed in 3.11.8.

    Fixed in 3.11.8 (released Aug 27, 2026, 21 days before disclosure).

    The latest release, 3.12.2, is not affected.

    11% of vm2 downloads last week were affected versions (173.2K).

Show all 78 advisoriesShow fewer advisories

  • vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass

    Affected: from 3.11.4, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    9% of vm2 downloads last week were affected versions (141.1K).

  • CVE-2026-92951Critical 9.4

    vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92950Critical 9.3

    vm2 before 3.11.7 Sandbox Escape via CLI require

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92949Medium 6.3

    vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor

    Affected: from 3.9.6, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    66% of vm2 downloads last week were affected versions (1M).

  • CVE-2026-92948Critical 9.4

    vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test

    Affected: from 3.9.6, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    66% of vm2 downloads last week were affected versions (1M).

  • CVE-2026-92947Critical 10.0

    vm2 before 3.11.7 Memory Disclosure via Buffer Pool

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92946Critical 10.0

    vm2 before 3.11.7 Remote Code Execution via require.external

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92944Critical 9.3

    vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector

    Affected: from 3.10.2, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    16% of vm2 downloads last week were affected versions (259.4K).

  • vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry

    Affected: fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    70% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92941Critical 10.0

    vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

    Affected: from 3.11.3, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    9.7% of vm2 downloads last week were affected versions (152.8K).

  • CVE-2026-92940Critical 10.0

    vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent

    Affected: from 3.11.3, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    9.7% of vm2 downloads last week were affected versions (152.8K).

  • CVE-2026-92939Critical 9.4

    vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine

    Affected: from 3.11.3, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    9.7% of vm2 downloads last week were affected versions (152.8K).

  • CVE-2026-92938Critical 9.4

    vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

    Affected: from 3.11.3, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    9.7% of vm2 downloads last week were affected versions (152.8K).

  • CVE-2026-92937Critical 10.0

    vm2 3.11.6 Remote Code Execution via Promise call/apply

    Affected: from 3.11.6, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    2.4% of vm2 downloads last week were affected versions (38.4K).

  • CVE-2026-92936Medium 6.9

    vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

    Affected: from 3.11.0, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    10% of vm2 downloads last week were affected versions (160.7K).

  • CVE-2026-92935Critical 9.5

    vm2 NodeVM Remote Code Execution via Array-Shaped Require

    Affected: from 3.11.4, fixed in 3.11.7.

    Fixed in 3.11.7 (released Aug 24, 2026, 24 days before disclosure).

    The latest release, 3.12.2, is not affected.

    9% of vm2 downloads last week were affected versions (141.1K).

  • CVE-2026-92934Critical 9.5

    vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

    Affected: fixed in 3.11.8.

    Fixed in 3.11.8 (released Aug 27, 2026, 21 days before disclosure).

    The latest release, 3.12.2, is not affected.

    71% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-92933Medium 6.9

    vm2 before 3.11.8 Information Disclosure via util.getCallSites

    Affected: fixed in 3.11.8.

    Fixed in 3.11.8 (released Aug 27, 2026, 21 days before disclosure).

    The latest release, 3.12.2, is not affected.

    71% of vm2 downloads last week were affected versions (1.1M).

  • vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

    Affected: fixed in 3.11.6.

    Fixed in 3.11.6 (released Aug 14, 2026, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    68% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-47686Critical 9.9

    vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE

    Affected: fixed in 3.11.6.

    Fixed in 3.11.6 (released Aug 14, 2026, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    68% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-47698Critical 9.8

    vm2: Sandbox Breakout Using Dangerous Host Proto Mutators

    Affected: fixed in 3.11.6.

    Fixed in 3.11.6 (released Aug 14, 2026, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    68% of vm2 downloads last week were affected versions (1.1M).

  • CVE-2026-47141Medium 6.9

    vm2: NodeVM observability builtins leak host process and HTTP request data

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • CVE-2026-47210Critical 9.8

    vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • CVE-2026-47208Critical 10.0

    vm2: Sandbox Breakout Using Promise Species

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • CVE-2026-47140Critical 10.0

    vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • CVE-2026-47137Critical 10.0

    vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • CVE-2026-47131Critical 10.0

    vm2: Sandbox Escape

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain

    Affected: fixed in 3.11.4.

    Fixed in 3.11.4 (released May 18, 2026, 25 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (966.3K).

  • CVE-2026-44005Critical 10.0

    vm2: Sandbox escape

    Affected: from 3.9.6, fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    56% of vm2 downloads last week were affected versions (878K).

  • CVE-2026-45411Critical 9.8

    vm2: Sandbox Breakout Using Async Generator

    Affected: fixed in 3.11.3.

    Fixed in 3.11.3 (released May 11, 2026, 2 days before disclosure).

    The latest release, 3.12.2, is not affected.

    61% of vm2 downloads last week were affected versions (954.6K).

  • CVE-2026-44009Critical 9.8

    vm2: Sandbox Breakout Through Null Proto Exception

    Affected: fixed in 3.11.2.

    Fixed in 3.11.2 (released May 3, 2026, 10 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (947.4K).

  • CVE-2026-44008Critical 9.8

    vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`

    Affected: fixed in 3.11.2.

    Fixed in 3.11.2 (released May 3, 2026, 10 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (947.4K).

  • CVE-2026-44007Critical 9.1

    vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution

    Affected: fixed in 3.11.1.

    Fixed in 3.11.1 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (947.1K).

  • CVE-2026-44006Critical 10.0

    vm2: Sandbox Escape

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-44003Medium 5.3

    vm2: Transformer Fast-Path Bypass Exposes Internal State Variable

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-44002Medium 5.8

    vm2: Host File Path Disclosure via Stack Trace Information Leak

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-44000Medium 6.5

    vm2: sandbox boundary bypass via host Promise resolution preserving host object identity

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-43999Critical 9.9

    vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape

    Affected: from 3.10.5, fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    3.9% of vm2 downloads last week were affected versions (61.8K).

  • vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape

    Affected: from 3.10.5, fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    3.9% of vm2 downloads last week were affected versions (61.8K).

  • CVE-2026-43997Critical 10.0

    vm2: Sandbox Escape

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 12 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-26956Critical 9.8

    vm2: WASM Sandbox Escape (Node 25 only)

    Affected: fixed in 3.10.5.

    Fixed in 3.10.5 (released Feb 17, 2026, 76 days before disclosure).

    The latest release, 3.12.2, is not affected.

    56% of vm2 downloads last week were affected versions (884.9K).

  • CVE-2026-26332Critical 9.8

    vm2: Sandbox Escape

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-24781Critical 9.8

    vm2: Sandbox Breakout Through Inspect

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-24120Critical 9.8

    vm2: Sandbox Breakout Through Promise Species

    Affected: fixed in 3.10.5.

    Fixed in 3.10.5 (released Feb 17, 2026, 76 days before disclosure).

    The latest release, 3.12.2, is not affected.

    56% of vm2 downloads last week were affected versions (884.9K).

  • CVE-2026-24118Critical 9.8

    VM2 Sandbox Breakout Through lookupGetter

    Affected: fixed in 3.11.0.

    Fixed in 3.11.0 (released May 1, 2026, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    60% of vm2 downloads last week were affected versions (946.7K).

  • CVE-2026-22709Critical 9.8

    vm2 has a Sandbox Escape

    Affected: fixed in 3.10.2.

    Fixed in 3.10.2 (released Jan 17, 2026, 9 days before disclosure).

    The latest release, 3.12.2, is not affected.

    54% of vm2 downloads last week were affected versions (848K).

  • CVE-2023-37903Critical 9.8

    Sandbox Escape in vm2

    Affected: through 3.9.19.

    Fixed in 3.10.0 (released Oct 24, 2025, 826 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.12.2, is not affected.

    47% of vm2 downloads last week were affected versions (739K).

  • CVE-2023-37466Critical 9.8

    vm2 Sandbox Escape vulnerability

    Affected: fixed in 3.10.0.

    Fixed in 3.10.0 (released Oct 24, 2025, 834 days after disclosure).

    The latest release, 3.12.2, is not affected.

    47% of vm2 downloads last week were affected versions (739K).

  • CVE-2023-32314Critical 9.8

    Sandbox Escape

    Affected: fixed in 3.9.18.

    Fixed in 3.9.18 (released May 15, 2023, the day of disclosure).

    The latest release, 3.12.2, is not affected.

    19% of vm2 downloads last week were affected versions (302.5K).

  • CVE-2023-32313Medium 5.3

    Inspect method manipulation in vm2

    Affected: fixed in 3.9.18.

    Fixed in 3.9.18 (released May 15, 2023, the day of disclosure).

    The latest release, 3.12.2, is not affected.

    19% of vm2 downloads last week were affected versions (302.5K).

  • CVE-2023-30547Critical 9.8

    Sandbox Escape in vm2

    Affected: fixed in 3.9.17.

    Fixed in 3.9.17 (released Apr 17, 2023, the day of disclosure).

    The latest release, 3.12.2, is not affected.

    17% of vm2 downloads last week were affected versions (268.7K).

  • CVE-2023-29199Critical 9.8

    vm2 Sandbox escape vulnerability

    Affected: fixed in 3.9.16.

    Fixed in 3.9.16 (released Apr 11, 2023, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    17% of vm2 downloads last week were affected versions (264.2K).

  • CVE-2023-29017Critical 10.0

    vm2 Sandbox Escape vulnerability

    Affected: fixed in 3.9.15.

    Fixed in 3.9.15 (released Apr 6, 2023, the day of disclosure).

    The latest release, 3.12.2, is not affected.

    17% of vm2 downloads last week were affected versions (262.5K).

  • CVE-2022-25893Critical 9.8

    Arbitrary Code Execution

    Affected: fixed in 3.9.10.

    Fixed in 3.9.10 (released Jul 5, 2022, 169 days before disclosure).

    The latest release, 3.12.2, is not affected.

    7.6% of vm2 downloads last week were affected versions (119.2K).

  • CVE-2022-36067Critical 10.0

    vm2 vulnerable to Sandbox Escape before v3.9.11

    Affected: fixed in 3.9.11.

    Fixed in 3.9.11 (released Aug 28, 2022, 9 days before disclosure).

    The latest release, 3.12.2, is not affected.

    8.6% of vm2 downloads last week were affected versions (134.5K).

  • Sandbox Bypass

    Affected: fixed in 3.6.11.

    Fixed in 3.6.11 (released Apr 7, 2019, 1193 days before disclosure).

    The latest release, 3.12.2, is not affected.

    0.4% of vm2 downloads last week were affected versions (6.9K).

  • CVE-2021-23555Critical 9.8

    Sandbox Bypass

    Affected: fixed in 3.9.6.

    Fixed in 3.9.6 (released Feb 8, 2022, 3 days before disclosure).

    The latest release, 3.12.2, is not affected.

    4.4% of vm2 downloads last week were affected versions (68.7K).

  • CVE-2021-23449Critical 9.8

    Sandbox Bypass

    Affected: fixed in 3.9.4.

    Fixed in 3.9.4 (released Oct 12, 2021, 6 days before disclosure).

    The latest release, 3.12.2, is not affected.

    3% of vm2 downloads last week were affected versions (47.5K).