Tag
vm2 CVE-2023-37903 Patch Bypass: Remote Code Execution
2 rules 1 TTP 1 CVEThe vm2 npm package has a remote code execution vulnerability due to a patch bypass for CVE-2023-37903; the vulnerability occurs because the check for `nesting: true` and `require: false` in `nodevm.js` uses strict equality, which can be bypassed by omitting the `require` option entirely, allowing an attacker to execute arbitrary OS commands.
VM2 Sandbox Escape via JSPI Promise .finally() Species Bypass (CVE-2026-47210)
2 rules 2 TTPsA sandbox escape vulnerability, CVE-2026-47210, in `vm2` allows arbitrary code execution in the host process when untrusted code is executed with async support on runtimes exposing WebAssembly JSPI, bypassing Promise-species hardening and exposing a host-originated rejection object to attacker-controlled species logic.
VM2 Sandbox Breakout Vulnerability via Promise Species Manipulation (CVE-2026-47208)
2 rules 1 TTPVM2 is vulnerable to a sandbox breakout vulnerability (CVE-2026-47208) that allows attackers to execute arbitrary commands on the host system by manipulating Promise species and escaping the sandbox context.
Multiple Vulnerabilities in vm2
2 rules 5 TTPsMultiple vulnerabilities in vm2 allow a remote, anonymous attacker to execute arbitrary code, bypass security measures, manipulate data, and disclose sensitive information.
vm2 Vulnerability Allows Code Execution
2 rules 1 TTPA remote, anonymous attacker can exploit a vulnerability in vm2 to execute arbitrary code, potentially leading to arbitrary code execution on the host system.
vm2 Sandbox Escape via Buffer.alloc Memory Exhaustion
3 rules 2 TTPsA vulnerability exists in the vm2 npm package (<= 3.10.5) where sandboxed code can bypass the timeout protection by calling Buffer.alloc() with an arbitrary size, leading to memory exhaustion on the host system.
VM2 Sandbox Escape Vulnerability (CVE-2026-26956)
2 rules 2 TTPs 1 CVEA critical vulnerability, CVE-2026-26956, exists in vm2 version 3.10.4 when running on Node.js v25.6.1 (x64 Linux), allowing a full sandbox escape with arbitrary code execution through attacker-controlled code passed to `VM.run()`.
vm2 NodeVM Nesting Bypass Allows Arbitrary Command Execution
2 rules 2 TTPsA vulnerability in vm2's NodeVM, when nesting is enabled, allows sandbox code to bypass require restrictions, enabling arbitrary OS command execution on the host.
vm2 Sandbox Escape via Promise Constructor Unhandled Rejection
2 rules 1 TTP 1 CVEA sandbox escape vulnerability exists in vm2 versions 3.10.5 and earlier that allows sandboxed code to crash the host Node.js process via a Promise constructor that triggers an unhandled rejection, leading to a denial-of-service condition.