{"schema_version":1,"title":"Vm2 vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in Vm2: 0 in the last 7 days and 15 in the last 90 days, 10 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM sandbox escape via child_process, was published on 18 September 2026. Nothing in the last four weeks, down from 15 vulnerabilities in the four before. 0 critical against 10. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/vm2","json_url":"https://junglewise.ai/threats/vendors/vm2.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/vm2","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":3,"all_time":19,"critical":10,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":15,"last_365_days":15},"latest":[{"cvss":10,"slug":"duplicate-advisory-vm2-contains-a-sandbox-escape-vulnerability-3d9d2178","title":"vm2 NodeVM sandbox escape via child_process","severity":"critical","exploited":false,"published_at":"2026-09-18T15:32:19+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-contains-a-sandbox-escape-vulnerability-3d9d2178"},{"cvss":10,"slug":"duplicate-advisory-nodevm-require-external-without-an-explicit-require-d0e93102","title":"vm2 NodeVM require.external RCE via unrestricted path traversal","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-nodevm-require-external-without-an-explicit-require-d0e93102"},{"cve":"CVE-2026-92960","cvss":10,"epss":0.0047,"slug":"cve-2026-92960-vm2-nodevm-builtin-wildcard-sandbox-escape-via-os-and-dns-modules","title":"vm2 NodeVM builtin wildcard sandbox escape via os and dns modules","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:02.29+00:00","url":"https://junglewise.ai/threats/cve-2026-92960-vm2-nodevm-builtin-wildcard-sandbox-escape-via-os-and-dns-modules"},{"cve":"CVE-2026-92958","cvss":8.5,"epss":0.0038,"slug":"cve-2026-92958-vm2-builtin-denylist-bypass-in-nodevm","title":"vm2 builtin denylist bypass in NodeVM","severity":"high","exploited":false,"published_at":"2026-09-17T14:18:01.97+00:00","url":"https://junglewise.ai/threats/cve-2026-92958-vm2-builtin-denylist-bypass-in-nodevm"},{"cve":"CVE-2026-92957","cvss":9.9,"epss":0.0054,"slug":"cve-2026-92957-vm2-nodevm-builtin-deny-list-bypass-via-node-prefixed-specifiers","title":"vm2 NodeVM builtin deny-list bypass via node:-prefixed specifiers","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.813+00:00","url":"https://junglewise.ai/threats/cve-2026-92957-vm2-nodevm-builtin-deny-list-bypass-via-node-prefixed-specifiers"},{"cve":"CVE-2026-92956","cvss":10,"epss":0.0059,"slug":"cve-2026-92956-vm2-sandbox-escape-via-webassembly-compilestreaming","title":"vm2 sandbox escape via WebAssembly.compileStreaming","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.64+00:00","url":"https://junglewise.ai/threats/cve-2026-92956-vm2-sandbox-escape-via-webassembly-compilestreaming"},{"cve":"CVE-2026-92955","cvss":10,"epss":0.0071,"slug":"cve-2026-92955-vm2-sandbox-escape-in-nodevm-via-proto-manipulation","title":"vm2 sandbox escape in NodeVM via __proto__ manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.48+00:00","url":"https://junglewise.ai/threats/cve-2026-92955-vm2-sandbox-escape-in-nodevm-via-proto-manipulation"},{"cve":"CVE-2026-92950","cvss":8.6,"epss":0.002,"slug":"cve-2026-92950-vm2-sandbox-escape-in-cli-tool-via-require","title":"vm2 sandbox escape in CLI tool via require","severity":"high","exploited":false,"published_at":"2026-09-17T14:18:00.637+00:00","url":"https://junglewise.ai/threats/cve-2026-92950-vm2-sandbox-escape-in-cli-tool-via-require"},{"cve":"CVE-2026-92948","cvss":9.9,"epss":0.0065,"slug":"cve-2026-92948-vm2-nodevm-builtin-allowlist-bypass-and-sandbox-escape","title":"vm2 NodeVM builtin allowlist bypass and sandbox escape","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:00.31+00:00","url":"https://junglewise.ai/threats/cve-2026-92948-vm2-nodevm-builtin-allowlist-bypass-and-sandbox-escape"},{"cve":"CVE-2026-92945","cvss":4.2,"epss":0.0028,"slug":"cve-2026-92945-vm2-module-allowlist-bypass-via-prefix-matching","title":"vm2 module allowlist bypass via prefix matching","severity":"medium","exploited":false,"published_at":"2026-09-17T14:17:59.807+00:00","url":"https://junglewise.ai/threats/cve-2026-92945-vm2-module-allowlist-bypass-via-prefix-matching"},{"cve":"CVE-2026-92944","cvss":9.8,"epss":0.0084,"slug":"cve-2026-92944-vm2-sandbox-escape-via-promise-prototype-finally-on-node-js-26","title":"vm2 sandbox escape via Promise.prototype.finally() on Node.js 26","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.623+00:00","url":"https://junglewise.ai/threats/cve-2026-92944-vm2-sandbox-escape-via-promise-prototype-finally-on-node-js-26"},{"cve":"CVE-2026-92942","cvss":7.5,"epss":0.0049,"slug":"cve-2026-92942-vm2-timeout-bypass-via-finalizationregistry-callback","title":"vm2 timeout bypass via FinalizationRegistry callback","severity":"high","exploited":false,"published_at":"2026-09-17T14:17:59.467+00:00","url":"https://junglewise.ai/threats/cve-2026-92942-vm2-timeout-bypass-via-finalizationregistry-callback"},{"cve":"CVE-2026-92935","cvss":9,"epss":0.0067,"slug":"cve-2026-92935-vm2-sandbox-escape-via-array-shaped-require-option","title":"vm2 sandbox escape via array-shaped require option","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:57.81+00:00","url":"https://junglewise.ai/threats/cve-2026-92935-vm2-sandbox-escape-via-array-shaped-require-option"},{"cve":"CVE-2026-92934","cvss":9,"epss":0.0076,"slug":"cve-2026-92934-vm2-sandbox-escape-in-aggregateerror-handling","title":"vm2 sandbox escape in AggregateError handling","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:57.513+00:00","url":"https://junglewise.ai/threats/cve-2026-92934-vm2-sandbox-escape-in-aggregateerror-handling"},{"cve":"CVE-2026-92933","cvss":5.8,"epss":0.0037,"slug":"cve-2026-92933-vm2-sandbox-escape-via-util-getcallsites-information-disclosure","title":"vm2 sandbox escape via util.getCallSites information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-17T14:17:57.337+00:00","url":"https://junglewise.ai/threats/cve-2026-92933-vm2-sandbox-escape-via-util-getcallsites-information-disclosure"},{"cve":"CVE-2023-37903","cvss":3.1,"epss":0.0422,"slug":"cve-2023-37903-vm2-sandbox-escape-via-node-js-custom-inspect","title":"vm2 Sandbox Escape via Node.js custom inspect","severity":"low","exploited":false,"published_at":"2023-07-13T17:01:58+00:00","url":"https://junglewise.ai/threats/cve-2023-37903-vm2-sandbox-escape-via-node-js-custom-inspect"},{"cve":"CVE-2019-10761","cvss":3.1,"epss":0.0129,"slug":"cve-2019-10761-vm2-sandbox-escape-via-stack-overflow","title":"vm2 sandbox escape via stack overflow","severity":"low","exploited":false,"published_at":"2022-07-14T00:00:23+00:00","url":"https://junglewise.ai/threats/cve-2019-10761-vm2-sandbox-escape-via-stack-overflow"},{"cve":"CVE-2021-23555","cvss":3.1,"epss":0.0288,"slug":"cve-2021-23555-vm2-sandbox-bypass-via-host-error-objects","title":"vm2 sandbox bypass via host error objects","severity":"low","exploited":false,"published_at":"2022-02-12T00:00:38+00:00","url":"https://junglewise.ai/threats/cve-2021-23555-vm2-sandbox-bypass-via-host-error-objects"},{"cve":"CVE-2021-23449","cvss":3.1,"epss":0.0359,"slug":"cve-2021-23449-vm2-prototype-pollution-sandbox-escape","title":"vm2 prototype pollution sandbox escape","severity":"low","exploited":false,"published_at":"2021-10-19T15:28:45+00:00","url":"https://junglewise.ai/threats/cve-2021-23449-vm2-prototype-pollution-sandbox-escape"}],"vendor":{"hub":true,"name":"Vm2","slug":"vm2","description":"JavaScript runtime that executes code in an isolated sandbox environment.","url":"https://junglewise.ai/threats/vendors/vm2"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":10,"exploited":0,"vulnerabilities":15},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-92955","cvss":10,"epss":0.0071,"slug":"cve-2026-92955-vm2-sandbox-escape-in-nodevm-via-proto-manipulation","title":"vm2 sandbox escape in NodeVM via __proto__ manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.48+00:00","url":"https://junglewise.ai/threats/cve-2026-92955-vm2-sandbox-escape-in-nodevm-via-proto-manipulation"},{"cve":"CVE-2026-92956","cvss":10,"epss":0.0059,"slug":"cve-2026-92956-vm2-sandbox-escape-via-webassembly-compilestreaming","title":"vm2 sandbox escape via WebAssembly.compileStreaming","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.64+00:00","url":"https://junglewise.ai/threats/cve-2026-92956-vm2-sandbox-escape-via-webassembly-compilestreaming"},{"cve":"CVE-2026-92960","cvss":10,"epss":0.0047,"slug":"cve-2026-92960-vm2-nodevm-builtin-wildcard-sandbox-escape-via-os-and-dns-modules","title":"vm2 NodeVM builtin wildcard sandbox escape via os and dns modules","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:02.29+00:00","url":"https://junglewise.ai/threats/cve-2026-92960-vm2-nodevm-builtin-wildcard-sandbox-escape-via-os-and-dns-modules"},{"cvss":10,"slug":"duplicate-advisory-vm2-contains-a-sandbox-escape-vulnerability-3d9d2178","title":"vm2 NodeVM sandbox escape via child_process","severity":"critical","exploited":false,"published_at":"2026-09-18T15:32:19+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-contains-a-sandbox-escape-vulnerability-3d9d2178"},{"cvss":10,"slug":"duplicate-advisory-nodevm-require-external-without-an-explicit-require-d0e93102","title":"vm2 NodeVM require.external RCE via unrestricted path traversal","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-nodevm-require-external-without-an-explicit-require-d0e93102"},{"cve":"CVE-2026-92948","cvss":9.9,"epss":0.0065,"slug":"cve-2026-92948-vm2-nodevm-builtin-allowlist-bypass-and-sandbox-escape","title":"vm2 NodeVM builtin allowlist bypass and sandbox escape","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:00.31+00:00","url":"https://junglewise.ai/threats/cve-2026-92948-vm2-nodevm-builtin-allowlist-bypass-and-sandbox-escape"},{"cve":"CVE-2026-92957","cvss":9.9,"epss":0.0054,"slug":"cve-2026-92957-vm2-nodevm-builtin-deny-list-bypass-via-node-prefixed-specifiers","title":"vm2 NodeVM builtin deny-list bypass via node:-prefixed specifiers","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.813+00:00","url":"https://junglewise.ai/threats/cve-2026-92957-vm2-nodevm-builtin-deny-list-bypass-via-node-prefixed-specifiers"},{"cve":"CVE-2026-92944","cvss":9.8,"epss":0.0084,"slug":"cve-2026-92944-vm2-sandbox-escape-via-promise-prototype-finally-on-node-js-26","title":"vm2 sandbox escape via Promise.prototype.finally() on Node.js 26","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.623+00:00","url":"https://junglewise.ai/threats/cve-2026-92944-vm2-sandbox-escape-via-promise-prototype-finally-on-node-js-26"},{"cve":"CVE-2026-92934","cvss":9,"epss":0.0076,"slug":"cve-2026-92934-vm2-sandbox-escape-in-aggregateerror-handling","title":"vm2 sandbox escape in AggregateError handling","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:57.513+00:00","url":"https://junglewise.ai/threats/cve-2026-92934-vm2-sandbox-escape-in-aggregateerror-handling"},{"cve":"CVE-2026-92935","cvss":9,"epss":0.0067,"slug":"cve-2026-92935-vm2-sandbox-escape-via-array-shaped-require-option","title":"vm2 sandbox escape via array-shaped require option","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:57.81+00:00","url":"https://junglewise.ai/threats/cve-2026-92935-vm2-sandbox-escape-via-array-shaped-require-option"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Vm2","slug":"vm2-vm2","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/vm2-vm2"}]}