Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

4 records

Release: patriksimek vm2 3.12.1 Clear all filters
TI-2026-63069 CVE-2026-93605 · GHSA-9hxx-m5g2-2q3h · GHSA-pq68-rvw4-xp4r

vm2 NodeVM before 3.12.1 Remote Code Execution via child_process

Priority MEDIUM 49

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-spawning modules.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.0048 Published 2026-09-18 Fixed in 3.12.1 CWE-693
TI-2026-63068 CVE-2026-93604 · GHSA-qrp3-78q3-75rc

vm2 3.11.8 Sandbox Escape via crypto.setFips

Priority HIGH 70

vm2 through 3.12.0 exposes Node.js's crypto.setFips() function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM (require.builtin: ['crypto']).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00345 Published 2026-09-18 Fixed in 3.12.1 CWE-284
TI-2026-63067 CVE-2026-93603 · GHSA-2mqq-5j76-f3c6

vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

Priority HIGH 82

vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function withou…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00726 Published 2026-09-18 Fixed in 3.12.1 CWE-94