CVE-2023-37466

CVSS 3.1: 10.0 critical
EPSS: 4%p90
Published: Jul 14, 2023 · Jul 14, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-37466 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.

Vendors: vm2 project

Products: vm2

Weakness: CWE-94

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (3.9%)

In the news

2 stories

vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution

The Hacker NewsMay 11, 03:55 UTC · May 11, 2026VulnerabilityCVE-2026-24118 CVE-2026-24120 CVE-2023-37466+113 · 2 reads

Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution

The Hacker NewsJan 29, 06:05 UTC · Jan 29, 2026VulnerabilityCVE-2026-22709 CVE-2022-36067 CVE-2023-29017+54 · 2 reads