Sandbox Bypass
Priority MEDIUM 47CWE-1321Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
Why it matters now
EPSS 0.02876 86th percentileScored 2026-11-07
Fix Partial vm2: 3.9.6vm2 (npm): 3.9.6Red Hat: 1 advisoryRed Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | vm2 | before 3.9.6 | 3.9.6 | Patch available | CNA |
| — | vm2 (npm) | before 3.9.6 | 3.9.6 | Patch available | GHSA-6pw2-5hjv-9pf7 |
- vm2 Vendor— Affected before 3.9.6 Fixed in 3.9.6 Patch available CNA
- vm2 (npm) Vendor— Affected before 3.9.6 Fixed in 3.9.6 Patch available GHSA-6pw2-5hjv-9pf7
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* | before 3.9.6 | Vulnerable | patriksimek |
- cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:* Versions before 3.9.6 Vulnerable ·patriksimek
Remediation
- Fix · CNA vm2 Fixed in 3.9.6
- Fix · GHSA-6pw2-5hjv-9pf7 vm2 (npm) Fixed in 3.9.6 Advisory →
Red Hat 1 advisory
- RHSA-2022:1681 Released 2022-05-03 · Red Hat rating ModerateRed Hat Advanced Cluster Management 2.4.4 security updates and bug fixes
- Red Hat Advanced Cluster Management for Kubernetes 2.4 for RHEL 8 rhacm2/acm-grafana-rhel8, rhacm2/acm-must-gather-rhel8, rhacm2/acm-operator-bundle +47
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Advanced Cluster Management for Kubernetes 2 | Affected | No fix yet |
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23555
- 2026-10-03 Alias added: GHSA-6pw2-5hjv-9pf7
References
More patriksimek Vm2 vulnerabilities
- TI-2023-14382 Sandbox Escape in vm2 CVSS 3.1CRITICAL 10.0
- TI-2023-13478 vm2 Sandbox Escape vulnerability CVSS 3.1CRITICAL 10.0
- TI-2026-33200 vm2: Sandbox Breakout Using Async Generator CVSS 3.1CRITICAL 9.8
- TI-2026-32052 vm2: Sandbox Breakout Through Null Proto Exception CVSS 3.1CRITICAL 9.8
- TI-2026-32051 vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` CVSS 3.1CRITICAL 9.8
- TI-2026-32049 vm2: Sandbox Escape CVSS 3.1CRITICAL 10.0
Sources
- CVE-2021-23555 · CVE Program
- CVE-2021-23555 · NVD
- FIRST EPSS
- GHSA-6pw2-5hjv-9pf7 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23555 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences