1159 matches found
vm2
vm2 !NPM Versionnpm-imagenpm-url !NPM Downloadsdownloads-imagedownloads-url !Licenselicense-imagelicense-url !Known Vulnerabilitiessnyk-imagesnyk-url vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Installation npm install vm2 Quick Examples import VM from...
CVE-2023-30547
CVE-2023-30547 Vulnerability description vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException...
CVE-2026-92955
A flaw was found in vm2. This vulnerability allows an attacker running untrusted code within the sandbox to achieve arbitrary code execution on the host system. By accessing internal host properties through standard output streams, the untrusted code can manipulate process event handlers and esca...
CVE-2023-30547
CVE-2023-30547 PoC Exploit for VM2 Sandbox Escape Vulnerability alt img Description vm2 3.9.17 is vulnerable to arbitrary code execution due to a flaw in exception sanitization. Attackers can exploit this by triggering an unsanitized host exception within handleException, enabling them to escape...
NPM: vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
NPM: vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.4, = 3.11.6...
vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code. The prior nodejs. symbol hardening blocks Symbol.for'nodejs.' at the source, but the extraction filters and bridge...
EUVD-2026-81601
vm2: Incomplete nodejs. symbol filtering lets sandbox override host WebStream state checks...
GHSA-JF8Q-945G-9Q4C vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks
Summary vm2 current head v3.11.5, commit 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 still exposes registered Node.js internal symbols from host WebStream prototypes to sandbox code. The prior nodejs. symbol hardening blocks Symbol.for'nodejs.' at the source, but the extraction filters and bridge...
NPM: vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
NPM: vm2: NodeVM builtin allowlist bypass via node:test.run execArgv allows sandbox escape vulnerability discovered by ? in WordPress Npm vm2 versions = 3.9.6, = 3.11.6...
vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require'node:node:test' and call run with attacker-controlled execArgv. node:test.run starts a...
EUVD-2026-81597
vm2: NodeVM builtin allowlist bypass via node:test.run execArgv allows sandbox escape...
NPM: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
host-realm require is reachable from sandboxed scripts vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...
vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...
EUVD-2026-81599
vm2 CLI provides no sandbox isolation - host-realm require is reachable from sandboxed scripts...
NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
NPM: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.3, = 3.11.6...
EUVD-2026-81590
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent...
vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...
NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...