Product by Patriksimek
Vm2
77 known vulnerabilities in Vm2 (Patriksimek), 0 of them actively exploited (CISA KEV).
Key figures
77
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
51
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-29017 | vm2 Sandbox Escape vulnerability | 10.0 | |
| Critical | CVE-2023-30547 | Sandbox Escape in vm2 | 9.8 | |
| Critical | CVE-2022-36067 | vm2 vulnerable to Sandbox Escape before v3.9.11 | 10.0 | |
| Critical | CVE-2023-32314 | Sandbox Escape | 9.8 | |
| Critical | CVE-2023-37903 | Sandbox Escape in vm2 | 9.8 | |
| Critical | CVE-2023-37466 | vm2 Sandbox Escape vulnerability | 9.8 | |
| Critical | CVE-2023-29199 | vm2 Sandbox escape vulnerability | 9.8 | |
| Critical | CVE-2026-47210 | vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass | 9.8 | |
| Critical | CVE-2026-92937 | vm2 3.11.6 Remote Code Execution via Promise call/apply | 10.0 | |
| Critical | CVE-2026-92946 | vm2 before 3.11.7 Remote Code Execution via require.external | 10.0 | |
| Critical | CVE-2026-92944 | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector | 9.8 | |
| Critical | CVE-2026-47698 | vm2: Sandbox Breakout Using Dangerous Host Proto Mutators | 9.8 | |
| Critical | CVE-2026-24781 | vm2: Sandbox Breakout Through Inspect | 9.8 | |
| Critical | CVE-2026-22709 | vm2 has a Sandbox Escape | 9.8 | |
| Critical | CVE-2026-93605 | vm2 NodeVM before 3.12.1 Remote Code Execution via child_process | 10.0 | |
| Critical | CVE-2026-93603 | vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function | 10.0 | |
| Critical | CVE-2026-93606 | vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species | 10.0 | |
| Critical | CVE-2026-92955 | vm2 before 3.11.8 Sandbox Escape via NodeVM | 10.0 | |
| Critical | CVE-2026-26956 | vm2: WASM Sandbox Escape (Node 25 only) | 9.8 | |
| Critical | CVE-2026-92934 | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError | 9.0 | |
| Critical | CVE-2026-92948 | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test | 9.9 | |
| Critical | CVE-2026-43997 | vm2: Sandbox Escape | 10.0 | |
| Critical | CVE-2026-43999 | vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape | 9.9 | |
| Critical | CVE-2026-47208 | vm2: Sandbox Breakout Using Promise Species | 10.0 | |
| Critical | CVE-2026-92935 | vm2 NodeVM Remote Code Execution via Array-Shaped Require | 9.0 |