| 0 |
| url |
VCID-3srt-uk7n-xqcw |
| vulnerability_id |
VCID-3srt-uk7n-xqcw |
| summary |
Sandbox bypass in vm2 |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2021-23555 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.01104 |
| scoring_system |
epss |
| scoring_elements |
0.78559 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.01104 |
| scoring_system |
epss |
| scoring_elements |
0.78493 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.01104 |
| scoring_system |
epss |
| scoring_elements |
0.78572 |
| published_at |
2026-06-14T12:55:00Z |
|
| 3 |
| value |
0.01104 |
| scoring_system |
epss |
| scoring_elements |
0.78577 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2021-23555 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.6 |
| purl |
pkg:npm/vm2@3.9.6 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-ct4r-vjm4-4qby |
|
| 10 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 11 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 12 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 13 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 14 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 15 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 16 |
| vulnerability |
VCID-mqs7-x7bh-17ef |
|
| 17 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 18 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 19 |
| vulnerability |
VCID-rm74-p6v5-wkbj |
|
| 20 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 21 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 22 |
| vulnerability |
VCID-ua6c-rrsj-2kg6 |
|
| 23 |
| vulnerability |
VCID-vj51-w2rv-6qgu |
|
| 24 |
| vulnerability |
VCID-vsvp-q6bs-3qau |
|
| 25 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 26 |
| vulnerability |
VCID-w13m-snrt-5ud3 |
|
| 27 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.6 |
|
|
| aliases |
CVE-2021-23555, GHSA-6pw2-5hjv-9pf7
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-3srt-uk7n-xqcw |
|
| 1 |
| url |
VCID-55dr-v6ew-s3e8 |
| vulnerability_id |
VCID-55dr-v6ew-s3e8 |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, It is possible to reach BaseHandler.getPrototypeOf, which can be used to get arbitrary prototypes. This vulnerability is fixed in 3.11.0. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44006 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00061 |
| scoring_system |
epss |
| scoring_elements |
0.19606 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.00061 |
| scoring_system |
epss |
| scoring_elements |
0.19433 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00061 |
| scoring_system |
epss |
| scoring_elements |
0.19627 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00067 |
| scoring_system |
epss |
| scoring_elements |
0.21055 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44006 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44006, GHSA-qcp4-v2jj-fjx8
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-55dr-v6ew-s3e8 |
|
| 2 |
| url |
VCID-598j-pe72-qkh3 |
| vulnerability_id |
VCID-598j-pe72-qkh3 |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-45411 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00082 |
| scoring_system |
epss |
| scoring_elements |
0.24192 |
| published_at |
2026-06-13T12:55:00Z |
|
| 1 |
| value |
0.00082 |
| scoring_system |
epss |
| scoring_elements |
0.23987 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00082 |
| scoring_system |
epss |
| scoring_elements |
0.24183 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00089 |
| scoring_system |
epss |
| scoring_elements |
0.25545 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-45411 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.11.3 |
| purl |
pkg:npm/vm2@3.11.3 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-8au2-j7az-byfp |
|
| 1 |
| vulnerability |
VCID-c1qf-rxjq-p7hr |
|
| 2 |
| vulnerability |
VCID-cb3t-tejn-2fcn |
|
| 3 |
| vulnerability |
VCID-ecr5-kq87-2uez |
|
| 4 |
| vulnerability |
VCID-etxy-bh6c-zbdv |
|
| 5 |
| vulnerability |
VCID-kv67-9wty-p3hc |
|
| 6 |
| vulnerability |
VCID-r9rx-mrvp-97br |
|
| 7 |
| vulnerability |
VCID-sxnb-dxuh-hfbt |
|
| 8 |
| vulnerability |
VCID-tdv8-2vye-cyaw |
|
| 9 |
| vulnerability |
VCID-yg7p-bmb4-8fg7 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.11.3 |
|
|
| aliases |
CVE-2026-45411, GHSA-248r-7h7q-cr24
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-598j-pe72-qkh3 |
|
| 3 |
| url |
VCID-6fr8-3aqn-wyce |
| vulnerability_id |
VCID-6fr8-3aqn-wyce |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, it is possible to obtain the host Object. There are various ways to use the host Object, to escape the sandbox, one example would be using HostObject.getOwnPropertySymbols to obtain Symbol(nodejs.util.inspect.custom). This vulnerability is fixed in 3.11.0. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-43997 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.06381 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.06391 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00022 |
| scoring_system |
epss |
| scoring_elements |
0.06402 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00024 |
| scoring_system |
epss |
| scoring_elements |
0.07003 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-43997 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-43997, GHSA-47x8-96vw-5wg6
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-6fr8-3aqn-wyce |
|
| 4 |
|
| 5 |
| url |
VCID-77zs-22q5-d7ev |
| vulnerability_id |
VCID-77zs-22q5-d7ev |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox boundary violation in vm2 allows host object identity to cross into the sandbox through host Promise resolution. When a host-side Promise that resolves to a host object is exposed to the sandbox, the value delivered to the sandbox .then() callback preserves host identity. This allows the sandbox to interact with the host object directly, including performing identity checks using host-side WeakMap and mutating host object state from inside the sandbox. This behavior occurs because the Promise fulfillment wrapper uses ensureThis() instead of the stronger cross-realm conversion path (from() / proxy wrapping). If no prototype mapping is found, ensureThis() returns the original object. As a result, objects resolved by host Promises can cross the sandbox boundary without proper isolation. This vulnerability is fixed in 3.11.0. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44000 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00047 |
| scoring_system |
epss |
| scoring_elements |
0.14887 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00047 |
| scoring_system |
epss |
| scoring_elements |
0.15006 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00047 |
| scoring_system |
epss |
| scoring_elements |
0.15008 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00051 |
| scoring_system |
epss |
| scoring_elements |
0.16396 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44000 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44000, GHSA-mpf8-4hx2-7cjg
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-77zs-22q5-d7ev |
|
| 6 |
| url |
VCID-8he7-t256-1yct |
| vulnerability_id |
VCID-8he7-t256-1yct |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability through the inspect function. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24781 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40422 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40433 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40243 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.00186 |
| scoring_system |
epss |
| scoring_elements |
0.40411 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24781 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-24781, GHSA-v37h-5mfm-c47c
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8he7-t256-1yct |
|
| 7 |
| url |
VCID-8pe8-9mh9-27f3 |
| vulnerability_id |
VCID-8pe8-9mh9-27f3 |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's code transformer has a performance optimization that skips AST analysis when the code does not contain catch, import, or async keywords. This fast-path bypass allows sandboxed code to directly access the internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable, which exposes internal security functions (handleException, wrapWith, import). This vulnerability is fixed in 3.11.0. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44003 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00049 |
| scoring_system |
epss |
| scoring_elements |
0.1589 |
| published_at |
2026-06-13T12:55:00Z |
|
| 1 |
| value |
0.00049 |
| scoring_system |
epss |
| scoring_elements |
0.15743 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00049 |
| scoring_system |
epss |
| scoring_elements |
0.15881 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.17304 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44003 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44003, GHSA-wp5r-2gw5-m7q7
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-8pe8-9mh9-27f3 |
|
| 8 |
|
| 9 |
| url |
VCID-bcct-j6mk-z7hu |
| vulnerability_id |
VCID-bcct-j6mk-z7hu |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, sandboxed code can call Buffer.alloc() with an arbitrary size to allocate memory directly on the host heap. Because Buffer.alloc is a synchronous C++ native call, vm2's timeout option cannot interrupt it. A single request can exhaust host memory and crash the process with a FATAL ERROR: Reached heap limit. This vulnerability is fixed in 3.11.0. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44004 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00052 |
| scoring_system |
epss |
| scoring_elements |
0.16892 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.00052 |
| scoring_system |
epss |
| scoring_elements |
0.16741 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00052 |
| scoring_system |
epss |
| scoring_elements |
0.16906 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00057 |
| scoring_system |
epss |
| scoring_elements |
0.18309 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44004 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44004, GHSA-6785-pvv7-mvg7
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-bcct-j6mk-z7hu |
|
| 10 |
| url |
VCID-ct4r-vjm4-4qby |
| vulnerability_id |
VCID-ct4r-vjm4-4qby |
| summary |
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds. |
| references |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
| reference_url |
https://github.com/patriksimek/vm2/issues/467 |
| reference_id |
467 |
| reference_type |
|
| scores |
| 0 |
| value |
10 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
|
| 1 |
| value |
10.0 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track* |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-04-22T15:37:00Z/ |
|
|
| url |
https://github.com/patriksimek/vm2/issues/467 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.11 |
| purl |
pkg:npm/vm2@3.9.11 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 14 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 15 |
| vulnerability |
VCID-mqs7-x7bh-17ef |
|
| 16 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 17 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 18 |
| vulnerability |
VCID-rm74-p6v5-wkbj |
|
| 19 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 20 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 21 |
| vulnerability |
VCID-ua6c-rrsj-2kg6 |
|
| 22 |
| vulnerability |
VCID-vj51-w2rv-6qgu |
|
| 23 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 24 |
| vulnerability |
VCID-w13m-snrt-5ud3 |
|
| 25 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.11 |
|
|
| aliases |
CVE-2022-36067, GHSA-mrgp-mrhc-5jrq
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ct4r-vjm4-4qby |
|
| 11 |
| url |
VCID-g93v-7a6d-5bfm |
| vulnerability_id |
VCID-g93v-7a6d-5bfm |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44008 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00082 |
| scoring_system |
epss |
| scoring_elements |
0.24192 |
| published_at |
2026-06-13T12:55:00Z |
|
| 1 |
| value |
0.00082 |
| scoring_system |
epss |
| scoring_elements |
0.23987 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00082 |
| scoring_system |
epss |
| scoring_elements |
0.24183 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00089 |
| scoring_system |
epss |
| scoring_elements |
0.25545 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44008 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44008, GHSA-9qj6-qjgg-37qq
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-g93v-7a6d-5bfm |
|
| 12 |
| url |
VCID-gvhg-db7k-57ey |
| vulnerability_id |
VCID-gvhg-db7k-57ey |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, SuppressedError allows attackers to escape the sandbox and run arbitrary code. This issue has been patched in version 3.11.0. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-26332 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00088 |
| scoring_system |
epss |
| scoring_elements |
0.25392 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00088 |
| scoring_system |
epss |
| scoring_elements |
0.25406 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00088 |
| scoring_system |
epss |
| scoring_elements |
0.25389 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00088 |
| scoring_system |
epss |
| scoring_elements |
0.25191 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-26332 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
| 12 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-26332, GHSA-55hx-c926-fr95
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-gvhg-db7k-57ey |
|
| 13 |
| url |
VCID-hb4z-qz2p-rqc5 |
| vulnerability_id |
VCID-hb4z-qz2p-rqc5 |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, a sandbox escape vulnerability in vm2 v3.10.5 allows any sandboxed code to crash the host Node.js process via a single Promise constructor that triggers an unhandled rejection propagating to the host. The fix for CVE-2026-22709 (v3.10.2) only sanitized the onRejected callback in .then() and .catch() overrides and did not address the executor-to-unhandledRejection path. This vulnerability is fixed in 3.11.0. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44001 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00052 |
| scoring_system |
epss |
| scoring_elements |
0.16892 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.00052 |
| scoring_system |
epss |
| scoring_elements |
0.16741 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00052 |
| scoring_system |
epss |
| scoring_elements |
0.16906 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00057 |
| scoring_system |
epss |
| scoring_elements |
0.18309 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44001 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44001, GHSA-hw58-p9xv-2mjh
|
| risk_score |
4.0 |
| exploitability |
0.5 |
| weighted_severity |
8.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-hb4z-qz2p-rqc5 |
|
| 14 |
| url |
VCID-k9q9-7mgb-rbbf |
| vulnerability_id |
VCID-k9q9-7mgb-rbbf |
| summary |
vm2 is an open source vm/sandbox for Node.js. In version 3.10.4, vm2 is vulnerable to full sandbox escape with arbitrary code execution. Attacker code inside VM.run() obtains host process object and runs host commands with zero host cooperation. This issue has been patched in version 3.10.5. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-26956 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.32075 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.32096 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.31893 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.32079 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-26956 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.10.5 |
| purl |
pkg:npm/vm2@3.10.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 4 |
| vulnerability |
VCID-88m4-3mra-mqfc |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 14 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 15 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 16 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 17 |
| vulnerability |
VCID-x2zr-7eqd-m3b7 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.10.5 |
|
|
| aliases |
CVE-2026-26956, GHSA-ffh4-j6h5-pg66
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-k9q9-7mgb-rbbf |
|
| 15 |
| url |
VCID-kjca-h5yw-cudv |
| vulnerability_id |
VCID-kjca-h5yw-cudv |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.0, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.11.0. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24118 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00176 |
| scoring_system |
epss |
| scoring_elements |
0.39156 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00176 |
| scoring_system |
epss |
| scoring_elements |
0.39164 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00176 |
| scoring_system |
epss |
| scoring_elements |
0.38968 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.00176 |
| scoring_system |
epss |
| scoring_elements |
0.3914 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24118 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-24118, GHSA-grj5-jjm8-h35p
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-kjca-h5yw-cudv |
|
| 16 |
| url |
VCID-mqs7-x7bh-17ef |
| vulnerability_id |
VCID-mqs7-x7bh-17ef |
| summary |
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.17 |
| purl |
pkg:npm/vm2@3.9.17 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 14 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 15 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 16 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 17 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 18 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 19 |
| vulnerability |
VCID-ua6c-rrsj-2kg6 |
|
| 20 |
| vulnerability |
VCID-vj51-w2rv-6qgu |
|
| 21 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 22 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.17 |
|
|
| aliases |
CVE-2023-30547, GHSA-ch3r-j5x3-6q2m
|
| risk_score |
10.0 |
| exploitability |
2.0 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-mqs7-x7bh-17ef |
|
| 17 |
| url |
VCID-nkcm-wcbb-quhs |
| vulnerability_id |
VCID-nkcm-wcbb-quhs |
| summary |
vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-22709 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.17446 |
| published_at |
2026-06-13T12:55:00Z |
|
| 1 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.17418 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.1743 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00054 |
| scoring_system |
epss |
| scoring_elements |
0.17266 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-22709 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.10.2 |
| purl |
pkg:npm/vm2@3.10.2 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 4 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 5 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 6 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 7 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 8 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 9 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 10 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 11 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 12 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 13 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 14 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 15 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 16 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 17 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.10.2 |
|
|
| aliases |
CVE-2026-22709, GHSA-99p7-6v5w-7xg8
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-nkcm-wcbb-quhs |
|
| 18 |
| url |
VCID-pucd-5ym9-1bc8 |
| vulnerability_id |
VCID-pucd-5ym9-1bc8 |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This issue has been patched in version 3.10.5. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24120 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.3201 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.3203 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.32014 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00129 |
| scoring_system |
epss |
| scoring_elements |
0.31828 |
| published_at |
2026-06-11T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-24120 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.10.5 |
| purl |
pkg:npm/vm2@3.10.5 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 4 |
| vulnerability |
VCID-88m4-3mra-mqfc |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 14 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 15 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 16 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 17 |
| vulnerability |
VCID-x2zr-7eqd-m3b7 |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.10.5 |
|
|
| aliases |
CVE-2026-24120, GHSA-qvjj-29qf-hp7p
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-pucd-5ym9-1bc8 |
|
| 19 |
| url |
VCID-rm74-p6v5-wkbj |
| vulnerability_id |
VCID-rm74-p6v5-wkbj |
| summary |
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-29199 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.18512 |
| scoring_system |
epss |
| scoring_elements |
0.95416 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.18512 |
| scoring_system |
epss |
| scoring_elements |
0.95415 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.24972 |
| scoring_system |
epss |
| scoring_elements |
0.9629 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.24972 |
| scoring_system |
epss |
| scoring_elements |
0.96301 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-29199 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.16 |
| purl |
pkg:npm/vm2@3.9.16 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 14 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 15 |
| vulnerability |
VCID-mqs7-x7bh-17ef |
|
| 16 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 17 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 18 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 19 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 20 |
| vulnerability |
VCID-ua6c-rrsj-2kg6 |
|
| 21 |
| vulnerability |
VCID-vj51-w2rv-6qgu |
|
| 22 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 23 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.16 |
|
|
| aliases |
CVE-2023-29199, GHSA-xj72-wvfv-8985
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rm74-p6v5-wkbj |
|
| 20 |
| url |
VCID-rt16-s8w5-8qgy |
| vulnerability_id |
VCID-rt16-s8w5-8qgy |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.1, when a NodeVM is created with nesting: true, sandbox code can unconditionally require('vm2') regardless of the outer VM's require configuration — including require: false. With access to vm2, the sandbox constructs a new inner NodeVM with its own unrestricted require settings and executes arbitrary OS commands on the host. Any application that runs untrusted code inside a NodeVM with nesting: true is fully compromised. This vulnerability is fixed in 3.11.1. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44007 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00047 |
| scoring_system |
epss |
| scoring_elements |
0.15083 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00047 |
| scoring_system |
epss |
| scoring_elements |
0.15211 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.00047 |
| scoring_system |
epss |
| scoring_elements |
0.15207 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.00051 |
| scoring_system |
epss |
| scoring_elements |
0.166 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44007 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44007, GHSA-8hg8-63c5-gwmx
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-rt16-s8w5-8qgy |
|
| 21 |
| url |
VCID-tvb2-2e76-27av |
| vulnerability_id |
VCID-tvb2-2e76-27av |
| summary |
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
### Summary
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.
### Details
It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`.
### PoC
```js
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
``` |
| references |
|
| fixed_packages |
|
| aliases |
GHSA-2cm2-m3w5-gp2f
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-tvb2-2e76-27av |
|
| 22 |
| url |
VCID-ua6c-rrsj-2kg6 |
| vulnerability_id |
VCID-ua6c-rrsj-2kg6 |
| summary |
vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability. |
| references |
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.18 |
| purl |
pkg:npm/vm2@3.9.18 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 14 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 15 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 16 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 17 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 18 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 19 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 20 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.18 |
|
|
| aliases |
CVE-2023-32314, GHSA-whpj-8f3w-67p5
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-ua6c-rrsj-2kg6 |
|
| 23 |
| url |
VCID-vj51-w2rv-6qgu |
| vulnerability_id |
VCID-vj51-w2rv-6qgu |
| summary |
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-32313 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00712 |
| scoring_system |
epss |
| scoring_elements |
0.7277 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00712 |
| scoring_system |
epss |
| scoring_elements |
0.72846 |
| published_at |
2026-06-12T12:55:00Z |
|
| 2 |
| value |
0.01556 |
| scoring_system |
epss |
| scoring_elements |
0.81921 |
| published_at |
2026-06-14T12:55:00Z |
|
| 3 |
| value |
0.01556 |
| scoring_system |
epss |
| scoring_elements |
0.81929 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-32313 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.18 |
| purl |
pkg:npm/vm2@3.9.18 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 14 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 15 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 16 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 17 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 18 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 19 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 20 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.18 |
|
|
| aliases |
CVE-2023-32313, GHSA-p5gc-c584-jj6v
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vj51-w2rv-6qgu |
|
| 24 |
| url |
VCID-vsvp-q6bs-3qau |
| vulnerability_id |
VCID-vsvp-q6bs-3qau |
| summary |
|
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2022-25893 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00495 |
| scoring_system |
epss |
| scoring_elements |
0.66203 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.00495 |
| scoring_system |
epss |
| scoring_elements |
0.66297 |
| published_at |
2026-06-12T12:55:00Z |
|
| 2 |
| value |
0.00495 |
| scoring_system |
epss |
| scoring_elements |
0.66311 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00495 |
| scoring_system |
epss |
| scoring_elements |
0.66309 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2022-25893 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.10 |
| purl |
pkg:npm/vm2@3.9.10 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-ct4r-vjm4-4qby |
|
| 10 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 11 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 12 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 13 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 14 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 15 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 16 |
| vulnerability |
VCID-mqs7-x7bh-17ef |
|
| 17 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 18 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 19 |
| vulnerability |
VCID-rm74-p6v5-wkbj |
|
| 20 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 21 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 22 |
| vulnerability |
VCID-ua6c-rrsj-2kg6 |
|
| 23 |
| vulnerability |
VCID-vj51-w2rv-6qgu |
|
| 24 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 25 |
| vulnerability |
VCID-w13m-snrt-5ud3 |
|
| 26 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.10 |
|
|
| aliases |
CVE-2022-25893, GHSA-4w2j-2rg4-5mjw
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vsvp-q6bs-3qau |
|
| 25 |
| url |
VCID-vwem-gghh-t7hc |
| vulnerability_id |
VCID-vwem-gghh-t7hc |
| summary |
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0. |
| references |
| 0 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44002 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.11155 |
| published_at |
2026-06-12T12:55:00Z |
|
| 1 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.11089 |
| published_at |
2026-06-11T12:55:00Z |
|
| 2 |
| value |
0.00036 |
| scoring_system |
epss |
| scoring_elements |
0.11149 |
| published_at |
2026-06-13T12:55:00Z |
|
| 3 |
| value |
0.00039 |
| scoring_system |
epss |
| scoring_elements |
0.12184 |
| published_at |
2026-06-14T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2026-44002 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
|
| fixed_packages |
|
| aliases |
CVE-2026-44002, GHSA-v27g-jcqj-v8rw
|
| risk_score |
3.1 |
| exploitability |
0.5 |
| weighted_severity |
6.2 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-vwem-gghh-t7hc |
|
| 26 |
| url |
VCID-w13m-snrt-5ud3 |
| vulnerability_id |
VCID-w13m-snrt-5ud3 |
| summary |
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-29017 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.70647 |
| scoring_system |
epss |
| scoring_elements |
0.98725 |
| published_at |
2026-06-14T12:55:00Z |
|
| 1 |
| value |
0.70647 |
| scoring_system |
epss |
| scoring_elements |
0.98724 |
| published_at |
2026-06-13T12:55:00Z |
|
| 2 |
| value |
0.74958 |
| scoring_system |
epss |
| scoring_elements |
0.98891 |
| published_at |
2026-06-11T12:55:00Z |
|
| 3 |
| value |
0.74958 |
| scoring_system |
epss |
| scoring_elements |
0.98895 |
| published_at |
2026-06-12T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-29017 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
| reference_url |
https://github.com/patriksimek/vm2/issues/515 |
| reference_id |
515 |
| reference_type |
|
| scores |
| 0 |
| value |
10 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
|
| 1 |
| value |
9.8 |
| scoring_system |
cvssv3.1 |
| scoring_elements |
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
|
| 2 |
| value |
CRITICAL |
| scoring_system |
generic_textual |
| scoring_elements |
|
|
| 3 |
| value |
Track* |
| scoring_system |
ssvc |
| scoring_elements |
SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-02-10T16:10:48Z/ |
|
|
| url |
https://github.com/patriksimek/vm2/issues/515 |
|
| 7 |
|
| 8 |
|
| 9 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.9.15 |
| purl |
pkg:npm/vm2@3.9.15 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-6n7e-fz65-jfds |
|
| 4 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 5 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 6 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 7 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 8 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 9 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 10 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 11 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 12 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 13 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 14 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 15 |
| vulnerability |
VCID-mqs7-x7bh-17ef |
|
| 16 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 17 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 18 |
| vulnerability |
VCID-rm74-p6v5-wkbj |
|
| 19 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 20 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 21 |
| vulnerability |
VCID-ua6c-rrsj-2kg6 |
|
| 22 |
| vulnerability |
VCID-vj51-w2rv-6qgu |
|
| 23 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
| 24 |
| vulnerability |
VCID-wm49-3agn-rffg |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.9.15 |
|
|
| aliases |
CVE-2023-29017, GHSA-7jxr-cg7f-gpgv
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-w13m-snrt-5ud3 |
|
| 27 |
| url |
VCID-wm49-3agn-rffg |
| vulnerability_id |
VCID-wm49-3agn-rffg |
| summary |
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue. |
| references |
| 0 |
|
| 1 |
| reference_url |
https://api.first.org/data/v1/epss?cve=CVE-2023-37466 |
| reference_id |
|
| reference_type |
|
| scores |
| 0 |
| value |
0.04929 |
| scoring_system |
epss |
| scoring_elements |
0.8985 |
| published_at |
2026-06-11T12:55:00Z |
|
| 1 |
| value |
0.04929 |
| scoring_system |
epss |
| scoring_elements |
0.89887 |
| published_at |
2026-06-14T12:55:00Z |
|
| 2 |
| value |
0.04929 |
| scoring_system |
epss |
| scoring_elements |
0.89883 |
| published_at |
2026-06-12T12:55:00Z |
|
| 3 |
| value |
0.04929 |
| scoring_system |
epss |
| scoring_elements |
0.89889 |
| published_at |
2026-06-13T12:55:00Z |
|
|
| url |
https://api.first.org/data/v1/epss?cve=CVE-2023-37466 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
|
| fixed_packages |
| 0 |
| url |
pkg:npm/vm2@3.10.0 |
| purl |
pkg:npm/vm2@3.10.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-55dr-v6ew-s3e8 |
|
| 1 |
| vulnerability |
VCID-598j-pe72-qkh3 |
|
| 2 |
| vulnerability |
VCID-6fr8-3aqn-wyce |
|
| 3 |
| vulnerability |
VCID-77zs-22q5-d7ev |
|
| 4 |
| vulnerability |
VCID-8he7-t256-1yct |
|
| 5 |
| vulnerability |
VCID-8pe8-9mh9-27f3 |
|
| 6 |
| vulnerability |
VCID-8zk3-a7sw-u7an |
|
| 7 |
| vulnerability |
VCID-bcct-j6mk-z7hu |
|
| 8 |
| vulnerability |
VCID-g93v-7a6d-5bfm |
|
| 9 |
| vulnerability |
VCID-gbh7-h2ek-hqgg |
|
| 10 |
| vulnerability |
VCID-gvhg-db7k-57ey |
|
| 11 |
| vulnerability |
VCID-hb4z-qz2p-rqc5 |
|
| 12 |
| vulnerability |
VCID-k9q9-7mgb-rbbf |
|
| 13 |
| vulnerability |
VCID-kjca-h5yw-cudv |
|
| 14 |
| vulnerability |
VCID-nkcm-wcbb-quhs |
|
| 15 |
| vulnerability |
VCID-pucd-5ym9-1bc8 |
|
| 16 |
| vulnerability |
VCID-rt16-s8w5-8qgy |
|
| 17 |
| vulnerability |
VCID-tvb2-2e76-27av |
|
| 18 |
| vulnerability |
VCID-vwem-gghh-t7hc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:npm/vm2@3.10.0 |
|
|
| aliases |
CVE-2023-37466, GHSA-cchq-frgv-rjh5
|
| risk_score |
4.5 |
| exploitability |
0.5 |
| weighted_severity |
9.0 |
| resource_url |
http://public2.vulnerablecode.io/vulnerabilities/VCID-wm49-3agn-rffg |
|