Arbitrary Code Injection

🗓️ 04 May 2026 18:27:13Reported by Snyk Security DatabaseType

Vm2 sandbox vulnerability allows arbitrary code execution via resetPromiseSpecies; upgrade to 3.10.5+.

Reporter	Title	Published	Views	Family All 43
0day.today	vm2 - Sandbox Escape Exploit	18 Mar 202400:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to a remote attack and a denial of service due to Node.js modules protobuf.js, vm2 and word-wrap [CVE-2023-36665, CVE-2023-37903, CVE-2023-37466 and CVE-2023-26115]	11 Sep 202316:26	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands that use the Box or Snowflake connectors are vulnerable to arbitrary code execution due to [CVE-2023-37466], [CVE-2023-37903]	24 Aug 202315:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Instana Observability for Synthetic PoP is affected by vulnerabilities in vm2	15 Mar 202413:58	–	ibm
ATTACKERKB	CVE-2026-24120	4 May 202616:31	–	attackerkb
BDU FSTEC	The vulnerability of the NPM packet manager’s vm2 library, related to improper code generation management, allows a attacker to escape from a isolated programming environment and execute arbitrary code.	18 Jul 202300:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the resetPromiseSpecies() function in the vm2 package manager’s NPM library allows a hacker to bypass the sandbox protection mechanisms and execute arbitrary commands.	12 May 202600:00	–	bdu_fstec
Circl	CVE-2023-37466	12 Jul 202312:40	–	circl
Circl	CVE-2026-24120	4 May 202618:30	–	circl
CNNVD	vm2 代码注入漏洞	13 Jul 202300:00	–	cnnvd