Sandbox bypass in vm2

GHSA-6pw2-5hjv-9pf7 · CVE-2021-23555 · SNYK-JS-VM2-2309905

Published Feb 12, 2022 · Modified Jul 8, 2026

AI SAST

Find this class of vulnerability in your own code

Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.

Explore AI SAST Explore dependency scanning →

Description

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

References

ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2021-23555
WEB https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d
PACKAGE https://github.com/patriksimek/vm2
WEB https://snyk.io/vuln/SNYK-JS-VM2-2309905

Ready to move

Start Securing

Start for Free Get Demo

Free, no credit card | First findings in minutes

Sandbox bypass in vm2

Description

References

More npm vulnerabilities

Start Securing