Product by Vm2 Project
Vm2
32 known vulnerabilities in Vm2 (Vm2 Project), 0 of them actively exploited (CISA KEV).
Key figures
32
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
24
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-29017 | vm2 Sandbox Escape vulnerability | 10.0 | |
| Critical | CVE-2023-30547 | Sandbox Escape in vm2 | 9.8 | |
| Critical | CVE-2022-36067 | vm2 vulnerable to Sandbox Escape before v3.9.11 | 10.0 | |
| Critical | CVE-2023-32314 | Sandbox Escape | 9.8 | |
| Critical | CVE-2023-37903 | Sandbox Escape in vm2 | 9.8 | |
| Critical | CVE-2023-37466 | vm2 Sandbox Escape vulnerability | 9.8 | |
| Critical | CVE-2023-29199 | vm2 Sandbox escape vulnerability | 9.8 | |
| Critical | CVE-2021-23449 | Sandbox Bypass | 9.8 | |
| Critical | CVE-2021-23555 | Sandbox Bypass | 9.8 | |
| Critical | CVE-2026-24781 | vm2: Sandbox Breakout Through Inspect | 9.8 | |
| Critical | CVE-2026-22709 | vm2 has a Sandbox Escape | 9.8 | |
| Critical | CVE-2026-26956 | vm2: WASM Sandbox Escape (Node 25 only) | 9.8 | |
| Critical | CVE-2026-43997 | vm2: Sandbox Escape | 10.0 | |
| Critical | CVE-2026-43999 | vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape | 9.9 | |
| Critical | CVE-2022-25893 | Arbitrary Code Execution | 9.8 | |
| Critical | CVE-2026-24118 | VM2 Sandbox Breakout Through __lookupGetter__ | 9.8 | |
| Critical | CVE-2026-24120 | vm2: Sandbox Breakout Through Promise Species | 9.8 | |
| Critical | CVE-2026-44005 | vm2: Sandbox escape | 10.0 | |
| Critical | CVE-2026-44008 | vm2: Snabox breakout via `neutralizeArraySpeciesBatch` | 9.8 | |
| Critical | CVE-2026-44006 | vm2: Sandbox Escape | 10.0 | |
| Critical | CVE-2026-44007 | Patriksimek Vm2: Insufficient Isolation of System-Dependent Functions | 9.1 | |
| Critical | CVE-2026-44009 | vm2: Sandbox Breakout Through Null Proto Exception | 9.8 | |
| Critical | CVE-2026-26332 | vm2: Sandbox Escape | 10.0 | |
| Critical | CVE-2026-45411 | vm2: Sandbox Breakout Using Async Generator | 9.8 | |
| High | CVE-2026-43998 | vm2: NodeVM require.root bypass via symlink traversal allows sandbox escape | 8.5 |