Critical severity9.8NVD Advisory· Published Jul 14, 2023· Updated Jun 17, 2026
CVE-2023-37466
CVE-2023-37466
Description
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vm2npm | < 3.10.0 | 3.10.0 |
Affected products
3cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*+ 1 more
- cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*range: <=3.9.19
- (no CPE)range: <= 3.9.19
Patches
Vulnerability mechanics
References
9- github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5nvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-cchq-frgv-rjh5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-37466ghsaADVISORY
- gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9ghsaWEB
- github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744nvdWEB
- github.com/patriksimek/vm2/releases/tag/v3.10.0nvdWEB
- security.netapp.com/advisory/ntap-20230831-0007ghsaWEB
- security.netapp.com/advisory/ntap-20241108-0002ghsaWEB
- security.netapp.com/advisory/ntap-20241108-0002/nvd
News mentions
1- vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code ExecutionThe Hacker News · May 7, 2026