Skip to content
Threat Feed
Subscribe

Vendor

Vm2

4 briefs RSS
critical threat

NodeVM Sandbox Escape via Unrestricted OS and DNS Built-ins

The vm2 sandbox library fails to restrict the 'os' and 'dns' built-in modules when using the 'builtin: ['*']' configuration, enabling host-level information disclosure and process-wide DNS hijacking.

NodeVM vm2 nodejs sandbox-escape supply-chain
2t
critical advisory

vm2 Sandbox Escape Vulnerability (CVE-2026-47131)

A sandbox escape vulnerability exists in vm2 versions 3.11.3 and earlier, allowing attackers to execute arbitrary code on the host system by manipulating the prototype chain and exploiting Node.js error handling.

vm2 sandbox-escape rce javascript
2r 2t 1c
high advisory

vm2 Vulnerability Allows Code Execution

A remote, anonymous attacker can exploit a vulnerability in vm2 to execute arbitrary code, potentially leading to arbitrary code execution on the host system.

vm2 javascript-sandbox code-execution
2r 1t
critical advisory

VM2 Sandbox Escape Vulnerability (CVE-2026-26956)

A critical vulnerability, CVE-2026-26956, exists in vm2 version 3.10.4 when running on Node.js v25.6.1 (x64 Linux), allowing a full sandbox escape with arbitrary code execution through attacker-controlled code passed to `VM.run()`.

vm2 +1 sandbox-escape wasm javascript
2r 2t 1c