EUVD-2026-87858

vm2: NodeVM custom resolution bypasses external path boundaries...

EUVD-2026-87857

vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process...

EUVD-2026-87856

vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary...

GHSA-489W-W794-JQ94 vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Summary When an application explicitly exposes Node's zlib module through vm2's NodeVM builtin allowlist, an untrusted guest can obtain a pool-backed host Buffer from zlib.deflateSync, create a full-width view of its backing ArrayBuffer, read bytes outside the compressed result, and flip a byte i...

EUVD-2026-81608

vm2: allowAsync: false can be bypassed through Promise thenable assimilation in VM and NodeVM...

EUVD-2026-81604

vm2: Sandbox Escape NodeVM...

EUVD-2026-81603

vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process...

EUVD-2026-81602

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix...

GHSA-X965-FC75-JPQH vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

Summary vm2 3.11.6 this fork's latest release contains an incomplete-fix bypass of the Error.cause host-reference sanitization added in GHSA-m283-3h24-438v commit 7e3faaf. Sandbox code that catches a host-wrapped AggregateError which is revisited within a single handleException traversal...

EUVD-2026-81584

vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit...

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit

NPM: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.7...

EUVD-2026-81583

vm2: util.getCallSites bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack...

EUVD-2026-81586

vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting...

EUVD-2026-81592

vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback Unbounded Host Event-Loop Block...

GHSA-J3HM-6RG5-MCHV vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

EUVD-2026-81595

vm2: NodeVM require.external without an explicit require.root grants unrestricted host filesystem access and full RCE...

EUVD-2026-81596

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool...

EUVD-2026-81605

vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass...

vm2

vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2는 허용 목록에 등록된 Node의 내장 모듈로 신뢰할 수 없는 코드를 실행할 수 있는 샌드박스입니다. 설치sh npm install vm2 빠른 예제js import VM from 'vm2'; const vm = new VM; vm.runprocess.exi...

CVE-2023-30547

CVE-2023-30547 VM2 샌드박스 탈출 취약점 PoC 익스플로잇 대체 이미지 설명 vm2 3.9.17은 예외 처리 과정의 결함으로 인해 임의 코드 실행에 취약합니다. 공격자는 handleException 내에서 정제되지 않은 호스트 예외를 트리거하여 샌드박스를 탈출하고 호스트 컨텍스트에서 임의의 코드를 실행할 수 있습니다. VM2-Exploit ⚠️ "VM2-Exploit " 도구 사용을 고려해보세요. 이 도구는 VM2의 모든 버전 을 대상으로 사용할 수 있으며 사용하기 쉽습니다. 대상이 취약한지 식별 샌드박스에서 다음...