Skip to content
Threat Feed

Product

Vm2 (3.9.6 - 3.10.5)

1 brief RSS
critical advisory

vm2 Sandbox Escape via Prototype Pollution

A vulnerability in vm2 versions 3.9.6 through 3.10.5 allows attacker-controlled JavaScript running in a default VM or inherited NodeVM to mutate shared host prototypes from inside the sandbox, leading to sandbox escape and prototype pollution.

vm2 sandbox-escape prototype-pollution javascript
2r 2t