| CVE-2026-100721 |
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
|
9.5
Critical
|
Sep 27, 2026 |
| CVE-2026-93606 |
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
|
10.0
Critical
|
Sep 18, 2026 |
| CVE-2026-93605 |
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits…
|
10.0
Critical
|
Sep 18, 2026 |
| CVE-2026-93603 |
vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge…
|
10.0
Critical
|
Sep 18, 2026 |
| CVE-2026-92960 |
vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92957 |
vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92956 |
vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92955 |
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92953 |
vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation
|
9.3
Critical
|
Sep 17, 2026 |
| CVE-2026-92954 |
vm2 is a sandbox library for running untrusted JavaScript in Node.js
|
9.2
Critical
|
Sep 17, 2026 |
| CVE-2026-92950 |
vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary…
|
9.3
Critical
|
Sep 17, 2026 |
| CVE-2026-92951 |
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92947 |
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92948 |
vm2 versions >= 3.9.6…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92946 |
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92944 |
vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where…
|
9.3
Critical
|
Sep 17, 2026 |
| CVE-2026-92940 |
vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92941 |
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call…
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92939 |
vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92937 |
vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process
|
10.0
Critical
|
Sep 17, 2026 |
| CVE-2026-92938 |
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that…
|
9.4
Critical
|
Sep 17, 2026 |
| CVE-2026-92934 |
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited…
|
9.5
Critical
|
Sep 17, 2026 |
| CVE-2026-92935 |
vm2 is a sandbox for running untrusted Node.js code
|
9.5
Critical
|
Sep 17, 2026 |
| CVE-2026-47686 |
vm2 is an open source vm/sandbox for Node.js
|
9.9
Critical
|
Aug 17, 2026 |
| CVE-2026-47698 |
vm2 is an open source vm/sandbox for Node.js
|
9.8
Critical
|
Aug 17, 2026 |