Vulnerabilitycritical
Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-36067 | vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules | 10.0 | 48% | PoC ×2 | |
| CVE-2023-29017 | vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules | 9.8 | 63% | PoC ×2 | |
| CVE-2023-29199 | There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass… | 10.0 | 4% | PoC | |
| CVE-2023-30547 | vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules | 10.0 | 73% | PoC ×2 | |
| CVE-2023-32314 | vm2 is a sandbox that can run untrusted code with Node's built-in modules | 10.0 | 8% | PoC | |
| CVE-2023-37466 | vm2 is an advanced vm/sandbox for Node.js | 10.0 | 4% | PoC | |
| CVE-2023-37903 | vm2 is an open source vm/sandbox for Node.js | 10.0 | 4% | ||
| CVE-2026-22709 | vm2 is an open source vm/sandbox for Node.js | 10.0 | 1% | PoC |
From the original article
2 min read at thehackernews.com
Ravie Lakshmanan Jan 28, 2026 Vulnerability / Open Source A critical sandbox escape vulnerability has been disclosed in the popular vm2 Node. js library that, if successfully exploited, could allow attackers to run arbitrary code on the underlying operating system. The vulnerability, tracked as CVE-2026-22709 , carries a CVSS score of 9.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.