Sandbox Bypass
Priority LOW 39CWE-674Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-674.
Summary
This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code running the script allowing it to spawn a child_process and execute arbitrary code.
Why it matters now
EPSS 0.01329 71st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vm2: 3.6.11vm2 (npm): 3.6.11
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | vm2 | before 3.6.11 | 3.6.11 | Patch available | CNA |
| — | vm2 (npm) | before 3.6.11 | 3.6.11 | Patch available | GHSA-wf5x-cr3r-xr77 |
- vm2 Vendor— Affected before 3.6.11 Fixed in 3.6.11 Patch available CNA
- vm2 (npm) Vendor— Affected before 3.6.11 Fixed in 3.6.11 Patch available GHSA-wf5x-cr3r-xr77
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* | before 3.6.11 | Vulnerable | patriksimek |
- cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* Versions before 3.6.11 Vulnerable ·patriksimek
Remediation
- Fix · CNA vm2 Fixed in 3.6.11
- Fix · GHSA-wf5x-cr3r-xr77 vm2 (npm) Fixed in 3.6.11 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2019-10761
- 2026-10-03 Alias added: GHSA-wf5x-cr3r-xr77
References
More patriksimek Vm2 vulnerabilities
- TI-2023-14382 Sandbox Escape in vm2 CVSS 3.1CRITICAL 10.0
- TI-2023-13478 vm2 Sandbox Escape vulnerability CVSS 3.1CRITICAL 10.0
- TI-2026-33200 vm2: Sandbox Breakout Using Async Generator CVSS 3.1CRITICAL 9.8
- TI-2026-32052 vm2: Sandbox Breakout Through Null Proto Exception CVSS 3.1CRITICAL 9.8
- TI-2026-32051 vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` CVSS 3.1CRITICAL 9.8
- TI-2026-32049 vm2: Sandbox Escape CVSS 3.1CRITICAL 10.0
Sources
- CVE-2019-10761 · CVE Program
- CVE-2019-10761 · NVD
- FIRST EPSS
- GHSA-wf5x-cr3r-xr77 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences