Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-wm49-3agn-rffg
Vulnerability ID VCID-wm49-3agn-rffg
Aliases CVE-2023-37466
GHSA-cchq-frgv-rjh5
Summary vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-94 Improper Control of Generation of Code ('Code Injection')
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-37466.json
epss 0.04929 https://api.first.org/data/v1/epss?cve=CVE-2023-37466
epss 0.04929 https://api.first.org/data/v1/epss?cve=CVE-2023-37466
epss 0.04929 https://api.first.org/data/v1/epss?cve=CVE-2023-37466
cvssv3.1 9.8 https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
generic_textual CRITICAL https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-cchq-frgv-rjh5
cvssv3.1 9.8 https://github.com/patriksimek/vm2
generic_textual CRITICAL https://github.com/patriksimek/vm2
cvssv3.1 9.8 https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
generic_textual CRITICAL https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
ssvc Track https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
cvssv3.1 9.8 https://github.com/patriksimek/vm2/releases/tag/v3.10.0
generic_textual CRITICAL https://github.com/patriksimek/vm2/releases/tag/v3.10.0
ssvc Track https://github.com/patriksimek/vm2/releases/tag/v3.10.0
cvssv3.1 9.8 https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
cvssv3.1_qr CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
generic_textual CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
ssvc Track https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-37466
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2023-37466
cvssv3.1 9.8 https://security.netapp.com/advisory/ntap-20230831-0007
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20230831-0007
cvssv3.1 9.8 https://security.netapp.com/advisory/ntap-20241108-0002
generic_textual CRITICAL https://security.netapp.com/advisory/ntap-20241108-0002
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-37466.json
https://api.first.org/data/v1/epss?cve=CVE-2023-37466
https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
https://github.com/patriksimek/vm2
https://nvd.nist.gov/vuln/detail/CVE-2023-37466
https://security.netapp.com/advisory/ntap-20230831-0007
https://security.netapp.com/advisory/ntap-20241108-0002
2232376 https://bugzilla.redhat.com/show_bug.cgi?id=2232376
d9a1fde8ec5a5a9c9e5a69bf91d703950859d744 https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
GHSA-cchq-frgv-rjh5 https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
v3.10.0 https://github.com/patriksimek/vm2/releases/tag/v3.10.0
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-37466.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:22Z/ Found at https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/releases/tag/v3.10.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:22Z/ Found at https://github.com/patriksimek/vm2/releases/tag/v3.10.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:T/P:M/B:A/M:M/D:T/2024-10-15T17:36:22Z/ Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-37466
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20230831-0007
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20241108-0002
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.8985
EPSS Score 0.04929
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:24:39.357025+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/37xxx/CVE-2023-37466.json 38.6.0