CVE-2021-23555

PoC —

CVSS 3.1

9.8 critical

EPSS

3%p86

Published

Feb 11, 2022 (Feb 11, 2022)

Modified

Jun 17, 2026

Description

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

Vendors: vm2 project
Products: vm2
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (2.9%)

In the news0 stories

No ingested article mentions this CVE yet.