Technology · npm
vm2 (npm) vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 111 vulnerabilities in vm2 (npm): 0 in the last 7 days and 70 in the last 90 days, 60 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM path bypass in custom resolution, was published on 27 September 2026. Nothing in the last four weeks, down from 67 vulnerabilities in the four before. 0 critical against 40.
- Last 7 days
- 0
- Last 90 days
- 70
- Critical, all time
- 60
- Exploited in the wild
- 0
About vm2 (npm)
Node.js library that runs JavaScript code in an isolated virtual machine sandbox.
Latest vm2 (npm) vulnerabilities
- vm2 NodeVM path bypass in custom resolutioncriticalCVSS 9
- vm2 NodeVM zlib buffer pool information disclosurehighCVSS 7.5
- vm2 host Promise rejection denial of service in construct trapmediumCVSS 6.8
- CVE-2026-100723: vm2 sandbox escape via Buffer backing-store ownership bypasscriticalCVSS 10EPSS 0.3%
- CVE-2026-100722: vm2 unhandled Promise rejection in construct traphighCVSS 8.6EPSS 0.3%
- CVE-2026-100721: vm2 authorization bypass in NodeVM external-module resolvercriticalCVSS 10EPSS 0.4%
- vm2 NodeVM sandbox escape via child_processcriticalCVSS 10
- CVE-2026-93606: vm2 sandbox escape via Promise Symbol.species hijackcriticalCVSS 10EPSS 0.7%
- CVE-2026-93605: vm2 NodeVM sandbox escape via child_process denylist omissioncriticalCVSS 10EPSS 0.7%
- CVE-2026-93604: vm2 sandbox escape via crypto.setFips exposurehighCVSS 7.2EPSS 0.4%
- CVE-2026-93603: vm2 sandbox escape via nullish this receivercriticalCVSS 10EPSS 0.7%
- vm2 NodeVM sandbox escape via prototype pollutioncriticalCVSS 10
- vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypasscriticalCVSS 10
- vm2 allowAsync bypass through Promise thenable assimilationhighCVSS 7.1
- vm2 sandbox bypass via accessor descriptor in freeze/readonlymediumCVSS 4
- vm2 CLI sandbox escape via require(__filename)highCVSS 8.6
- vm2 Promise rejection denial of servicehighCVSS 8.6
- vm2 TypedArray and ArrayBuffer prototype mutation sandbox escapecriticalCVSS 10
- vm2 sandbox escape via incomplete symbol filteringmediumCVSS 6.8
- vm2 allowlist bypass via substring matching in module resolvercriticalCVSS 9.9
- vm2 NodeVM builtin deny-list bypass via node-prefixed specifierscriticalCVSS 9.9
- vm2 NodeVM builtin denylist bypass via fs/promiseshighCVSS 8.5
- vm2 module allowlist bypass via prefix matchingmediumCVSS 4.2
- vm2 NodeVM builtin allowlist bypass sandbox escapecriticalCVSS 9.9
- vm2 NodeVM require.external RCE via unrestricted path traversalcriticalCVSS 10
Most severe vm2 (npm) vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-92937: vm2 sandbox escape in Promise rejection handlingcriticalCVSS 10EPSS 1.0%
- CVE-2026-92946: vm2 remote code execution in NodeVM require.externalcriticalCVSS 10EPSS 0.9%
- CVE-2026-47208: patriksimek vm2 sandbox breakout via Promise species hijackcriticalCVSS 10EPSS 0.8%
- CVE-2026-44005: patriksimek vm2 sandbox escape via host prototype mutationcriticalCVSS 10EPSS 0.8%
- CVE-2026-47140: patriksimek vm2 sandbox escape via NodeVM builtin denylist bypasscriticalCVSS 10EPSS 0.8%
- CVE-2026-44006: patriksimek vm2 sandbox escape via arbitrary prototype accesscriticalCVSS 10EPSS 0.8%
- CVE-2026-43997: patriksimek vm2 sandbox escape via host object leakagecriticalCVSS 10EPSS 0.8%
- CVE-2026-93605: vm2 NodeVM sandbox escape via child_process denylist omissioncriticalCVSS 10EPSS 0.7%
- CVE-2026-93603: vm2 sandbox escape via nullish this receivercriticalCVSS 10EPSS 0.7%
- CVE-2026-93606: vm2 sandbox escape via Promise Symbol.species hijackcriticalCVSS 10EPSS 0.7%
Vulnerabilities per week
Nothing in the last four weeks, down from 67 vulnerabilities in the four before. 0 critical against 40. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 3 | 2 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 0 | 0 | |
| 14 Sep 2026 | 61 | 37 | |
| 21 Sep 2026 | 6 | 3 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 0 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many vm2 (npm) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/vm2)<a href="https://junglewise.ai/threats/technologies/vm2"><img src="https://junglewise.ai/threats/technologies/vm2/badge.svg" alt="vm2 (npm) vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/vm2.json, and this page as text at https://junglewise.ai/threats/technologies/vm2.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "vm2 (npm) vulnerabilities", https://junglewise.ai/threats/technologies/vm2, 13 November 2026.