CVE-2022-36067 vm2 vulnerable to Sandbox Escape before v3.9.11

🗓️ 06 Sep 2022 00:00:00Reported by GoogleType

osv

osv🔗 osv.dev👁 21 Views

vm2 sandbox allows remote code executio

Reporter	Title	Published	Views	Family All 35
GithubExploit	Exploit for Improper Control of Dynamically-Managed Code Resources in Vm2_Project Vm2	5 Nov 202213:28	–	githubexploit
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities	28 Jul 202301:39	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer operands that use the Box connector may be vulnerable to arbitrary code execution due to [CVE-2022-36067]	3 Nov 202217:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cloud Pak for Security includes components with multiple known vulnerabilities	19 Jan 202313:54	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	15 Dec 202203:09	–	ibm
BDU FSTEC	The vulnerability of the NPM package manager vm2 library allows a hacker to execute arbitrary code.	8 Sep 202200:00	–	bdu_fstec
Circl	CVE-2022-36067	10 Oct 202212:21	–	circl
CNNVD	vm2 安全漏洞	6 Sep 202200:00	–	cnnvd
CNVD	VM2 Remote Code Execution Vulnerability	8 Sep 202200:00	–	cnvd
CVE	CVE-2022-36067	6 Sep 202200:00	–	cve

Source	Link
github	www.github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36067.json
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-36067
security	www.security.netapp.com/advisory/ntap-20221017-0002/
github	www.github.com/patriksimek/vm2/issues/467
github	www.github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873
oxeye	www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067

02 Apr 2026 08:00Current

9.9High risk

Vulners AI Score9.9

CVSS 3.110

EPSS0.84468

cve-2022-36067 sandbox node's built-in modules remote code execution vulnerability patch