vm2 (npm)
Advisories
108
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.12.2 or later clears every advisory below that has a fix.
Upgrade commands
npm
npm install vm2@3.12.2yarn
yarn add vm2@3.12.2pnpm
pnpm add vm2@3.12.2Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-7rr2-8fr3-fjqx Duplicate Advisory: vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process Withdrawn |
Medium | < 3.12.2 | 3.12.2 |
| GHSA-43rv-jrfh-9mrr Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary Withdrawn |
High | < 3.12.2 | 3.12.2 |
| GHSA-c9wr-qm7p-p6vc Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries Withdrawn |
Critical | < 3.12.2 | 3.12.2 |
| GHSA-489w-w794-jq94 vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary |
High EPSS 0.39% |
< 3.12.2 | 3.12.2 |
| GHSA-2v2p-6j97-cjg9 vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process |
Medium EPSS 0.32% |
< 3.12.2 | 3.12.2 |
| GHSA-5h3f-q97h-ccvc vm2: NodeVM custom resolution bypasses external path boundaries |
Critical EPSS 0.59% |
< 3.12.2 | 3.12.2 |
| GHSA-9hxx-m5g2-2q3h Duplicate Advisory: vm2 contains a sandbox escape vulnerability Withdrawn |
Critical | < 3.12.1 | 3.12.1 |
| GHSA-pq68-rvw4-xp4r vm2 contains a sandbox escape vulnerability |
Critical EPSS 0.48% |
< 3.12.1 | 3.12.1 |
| GHSA-6fvh-fgmg-3x7v Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package Withdrawn |
Critical | <= 3.11.6 | No fix yet |
| GHSA-mgj2-jqjq-q8gg Duplicate Advisory: vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process Withdrawn |
High | >= 3.10.0, <= 3.11.7 | No fix yet |
| GHSA-hc6q-4vvg-jf79 Duplicate Advisory: vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts Withdrawn |
High | <= 3.11.6 | No fix yet |
| GHSA-hmpr-c9rf-qcrf Duplicate Advisory: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks Withdrawn |
Medium | >= 3.11.4, <= 3.11.6 | No fix yet |
| GHSA-gg6f-mhqm-f7gp Duplicate Advisory: Sandbox Escape (NodeVM) Withdrawn |
Critical | <= 3.11.7 | No fix yet |
| GHSA-9f3g-34x8-92jc Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor Withdrawn |
Medium | >= 3.9.6, <= 3.11.6 | No fix yet |
| GHSA-9538-79j2-h62h Duplicate Advisory: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM Withdrawn |
High | <= 3.11.7 | No fix yet |
| GHSA-7c3p-84r8-h79q Duplicate Advisory: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes Withdrawn |
High | <= 3.11.6 | No fix yet |
| GHSA-28q4-xrqh-9479 Duplicate Advisory: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process Withdrawn |
Critical | <= 3.11.6 | No fix yet |
| GHSA-538q-xxpg-6h4r Duplicate Advisory: vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass Withdrawn |
Critical | >= 3.10.1, <= 3.11.6 | No fix yet |
| GHSA-5v7w-95g5-pj6q Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix Withdrawn |
Critical | >= 3.11.0, <= 3.11.7 | No fix yet |
| GHSA-8mvv-mcc3-xwhh Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted Withdrawn |
Medium | <= 3.11.6 | No fix yet |
| GHSA-xq74-c7jx-8w5j Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store Withdrawn |
Critical | >= 3.11.3, <= 3.11.6 | No fix yet |
| GHSA-wqg3-r97q-73xm Duplicate Advisory: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape Withdrawn |
Critical | >= 3.9.6, <= 3.11.6 | No fix yet |
| GHSA-29x6-9qh5-83gg Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE Withdrawn |
Critical | <= 3.11.6 | No fix yet |
| GHSA-x5qg-8pq6-39h6 Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool Withdrawn |
Critical | <= 3.11.6 | No fix yet |
| GHSA-6jgm-4w45-vh8j Duplicate Advisory: vm2 crypto builtin loads attacker native code through setEngine Withdrawn |
Critical | >= 3.11.3, <= 3.11.6 | No fix yet |
| GHSA-9fxx-mv6c-j5xp Duplicate Advisory: NodeVM nesting guard accepts array-shaped require and permits host RCE Withdrawn |
Critical | >= 3.11.4, <= 3.11.6 | No fix yet |
| GHSA-3f84-vwv5-r42g Duplicate Advisory: vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection Withdrawn |
Critical | No fix yet | |
| GHSA-5843-9mh5-hhgw Duplicate Advisory: vm2 exposes host HTTPS credentials and TLS traffic through globalAgent Withdrawn |
Critical | >= 3.11.3, <= 3.11.6 | No fix yet |
| GHSA-2vh9-cv26-p97m Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack Withdrawn |
Medium | <= 3.11.7 | No fix yet |
| GHSA-vjcv-9j33-wj62 Duplicate Advisory: vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block) Withdrawn |
High | <= 3.11.6 | No fix yet |
| GHSA-m7cq-7f2q-f9fh Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite` Withdrawn |
Critical | >= 3.11.3, <= 3.11.6 | No fix yet |
| GHSA-63m2-qqch-jxv2 Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting Withdrawn |
Medium | >= 3.11.0, <= 3.11.6 | No fix yet |
| GHSA-4xmw-hh9q-4q7c Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit Withdrawn |
Critical | <= 3.11.7 | No fix yet |
| GHSA-hwr5-cm8v-c76q Duplicate Advisory: vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector Withdrawn |
Critical | >= 3.10.2, <= 3.11.6 | No fix yet |
| GHSA-f8gf-w286-fmq2 vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM |
High EPSS 0.45% |
< 3.11.8 | 3.11.8 |
| GHSA-6rh5-qq4q-97xh vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes |
High EPSS 0.38% |
< 3.11.7 | 3.11.7 |
| GHSA-8686-vhfx-7r3j vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process |
Critical EPSS 0.54% |
< 3.11.7 | 3.11.7 |
| GHSA-wjwh-qqvp-g4p4 vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass |
Critical EPSS 0.51% |
>= 3.10.1, < 3.11.7 | 3.11.7 |
| GHSA-88hf-g992-jg85 vm2: Sandbox Escape (NodeVM) |
Critical EPSS 0.71% |
< 3.11.8 | 3.11.8 |
| GHSA-gjq8-xm47-88rc vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process |
High EPSS 0.49% |
>= 3.10.0, < 3.11.8 | 3.11.8 |
| GHSA-3vgf-8m4q-q4qr vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix |
Critical EPSS 0.50% |
>= 3.11.0, < 3.11.8 | 3.11.8 |
| GHSA-jf8q-945g-9q4c vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checks |
High EPSS 0.46% |
>= 3.11.4, < 3.11.7 | 3.11.7 |
| GHSA-c48m-32m9-vx93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package |
Critical EPSS 0.47% |
< 3.11.7 | 3.11.7 |
| GHSA-jxxv-8r27-vm4p vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts |
Critical EPSS 0.20% |
< 3.11.7 | 3.11.7 |
| GHSA-633r-hq9m-c4ff vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor |
Medium EPSS 0.32% |
>= 3.9.6, < 3.11.7 | 3.11.7 |
| GHSA-qhwx-74w5-xhxq vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape |
Critical EPSS 0.65% |
>= 3.9.6, < 3.11.7 | 3.11.7 |
| GHSA-fcqc-726x-5wfc vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool |
Critical EPSS 0.48% |
< 3.11.7 | 3.11.7 |
| GHSA-j3hm-6rg5-mchv vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE |
Critical EPSS 0.78% |
< 3.11.7 | 3.11.7 |
| GHSA-7q3f-wx44-378m vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted |
Low EPSS 0.28% |
< 3.11.7 | 3.11.7 |
| GHSA-27g9-p43v-cw3v vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector |
Critical EPSS 0.84% |
>= 3.10.2, < 3.11.7 | 3.11.7 |
| GHSA-r4fx-v8hh-22mv vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block) |
High EPSS 0.49% |
< 3.11.7 | 3.11.7 |
| GHSA-98xx-8mx4-x7cm vm2 NodeVM can replace the host process TLS trust store |
Critical EPSS 0.29% |
>= 3.11.3, < 3.11.7 | 3.11.7 |
| GHSA-h85j-hv3c-qfgq vm2 exposes host HTTPS credentials and TLS traffic through globalAgent |
Critical EPSS 0.43% |
>= 3.11.3, < 3.11.7 | 3.11.7 |
| GHSA-46pr-c5wc-xffx vm2 crypto builtin loads attacker native code through setEngine |
Critical EPSS 0.62% |
>= 3.11.3, < 3.11.7 | 3.11.7 |
| GHSA-6w8r-xxw2-g3hx vm2 allows a sandboxed plugin to execute native code through `node:sqlite` |
Critical EPSS 0.62% |
>= 3.11.3, < 3.11.7 | 3.11.7 |
| GHSA-647f-g98j-qq25 vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection |
Critical EPSS 1.03% |
>= 3.11.6, < 3.11.7 | 3.11.7 |
| GHSA-x6m4-chr9-cg97 vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting |
Medium EPSS 0.46% |
>= 3.11.0, < 3.11.7 | 3.11.7 |
| GHSA-8hr7-r645-pc6w vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE |
Critical EPSS 0.64% |
>= 3.11.4, < 3.11.7 | 3.11.7 |
| GHSA-x965-fc75-jpqh vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit |
Critical EPSS 0.76% |
< 3.11.8 | 3.11.8 |
| GHSA-r273-hxvj-fxhp vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack |
Medium EPSS 0.37% |
< 3.11.8 | 3.11.8 |
| GHSA-v836-6xw4-9cx3 vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass |
High EPSS 0.53% |
< 3.11.6 | 3.11.6 |
| GHSA-m5w8-4gq2-6f8x vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f) |
Critical EPSS 0.47% |
< 3.11.6 | 3.11.6 |
| GHSA-cfcw-xp6x-25gj vm2: Sandbox Breakout Using Dangerous Host Proto Mutators |
Critical EPSS 0.97% |
< 3.11.6 | 3.11.6 |
| GHSA-m283-3h24-438v VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE |
Critical EPSS 0.58% |
< 3.11.6 | 3.11.6 |
| GHSA-gmc2-2x9w-cgh9 vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike |
High EPSS 0.54% |
< 3.11.6 | 3.11.6 |
| GHSA-9g8x-92q2-p28f NodeVM observability builtins leak host process and HTTP request data |
Medium EPSS 0.38% |
< 3.11.4 | 3.11.4 |
| GHSA-r9pm-gxmw-wv6p NodeVM network builtin exclusions bypass via internal _http_client and _http_server |
High EPSS 0.36% |
< 3.11.4 | 3.11.4 |
| GHSA-rp36-8xq3-r6c4 NodeVM builtin denylist bypass via process and inspector/promises allows host code execution |
Critical EPSS 0.98% |
< 3.11.4 | 3.11.4 |
| GHSA-6j2x-vhqr-qr7q vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass |
Critical EPSS 1.72% |
< 3.11.4 | 3.11.4 |
| GHSA-m4wx-m65x-ghrr vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE |
Critical EPSS 0.38% |
< 3.11.4 | 3.11.4 |
| GHSA-c4cf-2hgv-2qv6 vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain |
High EPSS 0.29% |
< 3.11.4 | 3.11.4 |
| GHSA-m5q2-4fm3-vfqp vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks |
High EPSS 0.27% |
< 3.11.4 | 3.11.4 |
| GHSA-76w7-j9cq-rx2j vm2 is Vulnerable to Sandbox Breakout Through Promise Species |
Critical EPSS 1.04% |
< 3.11.4 | 3.11.4 |
| GHSA-q3fm-4wcw-g57x vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter |
Low EPSS 0.15% |
< 3.11.4 | 3.11.4 |
| GHSA-v6mx-mf47-r5wg vm2 has a Sandbox Escape issue |
Critical EPSS 0.76% |
< 3.11.4 | 3.11.4 |
| GHSA-248r-7h7q-cr24 vm2 Has a Sandbox Breakout Using Async Generator |
Critical EPSS 0.57% |
< 3.11.3 | 3.11.3 |
| GHSA-2cm2-m3w5-gp2f vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` |
Medium EPSS 0.34% |
< 3.11.2 | 3.11.2 |
| GHSA-9vg3-4rfj-wgcm vm2 has Sandbox Breakout Through Null Proto Exception |
Critical EPSS 0.81% |
< 3.11.2 | 3.11.2 |
| GHSA-9qj6-qjgg-37qq vm2 has sandbox breakout via `neutralizeArraySpeciesBatch` |
Critical EPSS 0.85% |
< 3.11.2 | 3.11.2 |
| GHSA-8hg8-63c5-gwmx vm2 NodeVM `nesting: true` bypasses `require: false` allowing sandbox escape and arbitrary OS command execution |
Critical EPSS 0.96% |
< 3.11.1 | 3.11.1 |
| GHSA-cp6g-6699-wx9c vm2 has a NodeVM require.root bypass via symlink traversal that allows sandbox escape |
High EPSS 0.72% |
>= 3.10.5, < 3.11.0 | 3.11.0 |
| GHSA-wp5r-2gw5-m7q7 vm2's Transformer Fast-Path Bypass Exposes Internal State Variable |
Medium EPSS 0.25% |
< 3.11.0 | 3.11.0 |
| GHSA-v27g-jcqj-v8rw vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak |
Medium EPSS 0.24% |
< 3.11.0 | 3.11.0 |
| GHSA-mpf8-4hx2-7cjg vm2 Host Promise Resolution Preserves Object Identity Across Sandbox Boundary |
High EPSS 0.20% |
< 3.11.0 | 3.11.0 |
| GHSA-6785-pvv7-mvg7 vm2 Sandbox Access to Host Buffer.alloc Allows timeout Bypass Resulting in Memory Exhaustion |
High EPSS 0.42% |
< 3.11.0 | 3.11.0 |
| GHSA-hw58-p9xv-2mjh vm2 has a Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS) |
High EPSS 0.45% |
< 3.11.0 | 3.11.0 |
| GHSA-947f-4v7f-x2v8 vm2 has a NodeVM builtin allowlist bypass via `module` builtin's `Module._load` that allows sandbox escape |
Critical EPSS 0.97% |
>= 3.10.5, < 3.11.0 | 3.11.0 |
| GHSA-vwrp-x96c-mhwq vm2: Mutable Proxies for Host Intrinsic Prototypes Allows Sandbox Escape |
Critical EPSS 0.83% |
>= 3.9.6, < 3.11.0 | 3.11.0 |
| GHSA-47x8-96vw-5wg6 vm2 Access to Host Object Enables Sandbox Escape |
Critical EPSS 0.98% |
< 3.11.0 | 3.11.0 |
| GHSA-qcp4-v2jj-fjx8 vm2 has a Sandbox Escape Vulnerability |
Critical EPSS 0.81% |
< 3.11.0 | 3.11.0 |
| GHSA-ffh4-j6h5-pg66 VM2 Has a WASM Sandbox Escape |
Critical EPSS 1.09% |
< 3.10.5 | 3.10.5 |
| GHSA-55hx-c926-fr95 VM2 Has a Sandbox Escape Issue via SuppressedError |
Critical EPSS 0.71% |
< 3.11.0 | 3.11.0 |
| GHSA-v37h-5mfm-c47c VM2 Has Sandbox Breakout Through Inspect Function |
Critical EPSS 1.19% |
< 3.11.0 | 3.11.0 |
| GHSA-qvjj-29qf-hp7p VM2 Has Sandbox Breakout Through Promise Species |
Critical EPSS 0.90% |
< 3.10.5 | 3.10.5 |
| GHSA-grj5-jjm8-h35p VM2 Sandbox Breakout Through __lookupGetter__ |
Critical EPSS 0.91% |
< 3.11.0 | 3.11.0 |
| GHSA-99p7-6v5w-7xg8 vm2 has a Sandbox Escape |
Critical EPSS 1.27% |
< 3.10.2 | 3.10.2 |
| GHSA-cchq-frgv-rjh5 vm2 Sandbox Escape vulnerability |
Critical EPSS 3.87% |
< 3.10.0 | 3.10.0 |
| GHSA-g644-9gfx-q4q4 vm2 Sandbox Escape vulnerability |
Critical EPSS 4.21% |
<= 3.9.19 | No fix yet |
| GHSA-whpj-8f3w-67p5 vm2 Sandbox Escape vulnerability |
Critical EPSS 8.13% |
< 3.9.18 | 3.9.18 |
| GHSA-p5gc-c584-jj6v vm2 vulnerable to Inspect Manipulation |
Medium EPSS 0.79% |
< 3.9.18 | 3.9.18 |
| GHSA-ch3r-j5x3-6q2m vm2 Sandbox Escape vulnerability |
Critical EPSS 72.97% |
< 3.9.17 | 3.9.17 |
| GHSA-xj72-wvfv-8985 vm2 Sandbox Escape vulnerability |
Critical EPSS 3.85% |
< 3.9.16 | 3.9.16 |
| GHSA-7jxr-cg7f-gpgv vm2 vulnerable to sandbox escape |
Critical EPSS 63.19% |
< 3.9.15 | 3.9.15 |
| GHSA-4w2j-2rg4-5mjw vm2 vulnerable to Arbitrary Code Execution |
Critical EPSS 1.54% |
< 3.9.10 | 3.9.10 |
| GHSA-mrgp-mrhc-5jrq vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host |
Critical EPSS 47.87% |
< 3.9.11 | 3.9.11 |
| GHSA-wf5x-cr3r-xr77 vm2 before 3.6.11 vulnerable to sandbox escape |
High EPSS 1.33% |
< 3.6.11 | 3.6.11 |
| GHSA-6pw2-5hjv-9pf7 Sandbox bypass in vm2 |
Critical EPSS 2.88% |
< 3.9.6 | 3.9.6 |
| GHSA-rjf2-j2r6-q8gr Prototype Pollution in vm2 |
Critical EPSS 3.59% |
< 3.9.4 | 3.9.4 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor