vm2

vm2 vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Installation root@kitploit: npm install vm2 Quick Examples root@kitploit: import VM from 'vm2'; const vm = new VM; vm.runprocess.exit; // TypeError: process.exit is not a function root@kitploit: import Node...

CVE-2023-30547

CVE-2023-30547 PoC利用——VM2沙箱逃逸漏洞 alt img 描述 vm2 3.9.17 因异常清理机制缺陷而存在任意代码执行漏洞。攻击者可通过在 handleException 中触发未清理的主机异常来利用此漏洞，从而逃逸沙箱并在主机上下文中执行任意代码。 VM2-Exploit ⚠️ 建议使用 "VM2-Exploit " 工具，该工具可用来利用 所有版本 的 VM2，且易于使用。 判断目标是否存在漏洞 在沙箱中运行以下代码，判断目标是否存在漏洞。 root@kitploit: const version =...

CVE-2026-47683 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concatlist, totalLength or Buffer.fromarrayLike with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory...

EUVD-2026-36443

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, the fix for GHSA-8hg8-63c5-gwmx CVE-2023-37903 introduced a check in nodevm.js line 263 that blocks the combination nesting: true + require: false. However, the check uses strict equality options.require === false, which is...

CVE-2026-24120

vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in versio...

EUVD-2023-2028

Malicious code in bioql PyPI...