vm2 vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-92938Criticalvm2: vm2 allows a sandboxed plugin to execute native code through `node:sqlite`CVE-2026-92939Criticalvm2: vm2 crypto builtin loads attacker native code through setEngineCVE-2026-92944Criticalvm2: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protectorCVE-2026-92941Criticalvm2: vm2 NodeVM can replace the host process TLS trust storeCVE-2026-92945Mediumvm2: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlistedGHSA-V836-6XW4-9CX3Highvm2: vm2 has Memory Exhaustion DoS via bufferAllocLimit BypassGHSA-M5W8-4GQ2-6F8XCriticalvm2: vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of…CVE-2026-47698Criticalvm2: vm2: Sandbox Breakout Using Dangerous Host Proto MutatorsCVE-2026-47686Criticalvm2: VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCECVE-2026-47683Highvm2: vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLikeCVE-2026-47141Mediumvm2: NodeVM observability builtins leak host process and HTTP request dataCVE-2026-47139Highvm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_serverCVE-2026-47140Criticalvm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code executionCVE-2026-47210Criticalvm2: vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypassCVE-2026-47137Criticalvm2: vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCECVE-2026-47209Highvm2: vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chainCVE-2026-47135Highvm2: vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checksCVE-2026-47208Criticalvm2: vm2 is Vulnerable to Sandbox Breakout Through Promise SpeciesGHSA-Q3FM-4WCW-G57XLowvm2: vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatterCVE-2026-47131Criticalvm2: vm2 has a Sandbox Escape issueCVE-2026-45411Criticalvm2: vm2 Has a Sandbox Breakout Using Async GeneratorGHSA-2CM2-M3W5-GP2FMediumvm2: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`CVE-2026-44009Criticalvm2: vm2 has Sandbox Breakout Through Null Proto ExceptionCVE-2026-44008Criticalvm2: vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`CVE-2026-44007Criticalvm2: vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo