Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

6 records

Release: patriksimek vm2 3.11.8 Clear all filters
TI-2026-62622 CVE-2026-92959 · GHSA-9538-79j2-h62h · GHSA-f8gf-w286-fmq2

vm2 before 3.11.8 allowAsync Bypass via Promise Thenable

Priority MEDIUM 64

vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00449 Published 2026-09-17 Fixed in 3.11.8 CWE-693
TI-2026-62618 CVE-2026-92955 · GHSA-88hf-g992-jg85 · GHSA-gg6f-mhqm-f7gp

vm2 before 3.11.8 Sandbox Escape via NodeVM

Priority HIGH 82

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00712 Published 2026-09-17 Fixed in 3.11.8 CWE-913
TI-2026-62616 CVE-2026-92953 · GHSA-3vgf-8m4q-q4qr · GHSA-5v7w-95g5-pj6q

vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

Priority HIGH 79

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00501 Published 2026-09-17 Fixed in 3.11.8 CWE-913
TI-2026-62597 CVE-2026-92934 · GHSA-4xmw-hh9q-4q7c · GHSA-x965-fc75-jpqh

vm2 before 3.11.8 Sandbox Escape RCE via AggregateError

Priority HIGH 76

vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal.

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.00762 Published 2026-09-17 Fixed in 3.11.8 CWE-693