Critical severityNVD Advisory· Published Jul 13, 2023· Updated Jan 5, 2026
vm2 Sandbox Escape vulnerability
CVE-2023-37466
Description
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vm2npm | < 3.10.0 | 3.10.0 |
Affected products
2- Range: <= 3.9.19
Patches
Vulnerability mechanics
References
8- github.com/advisories/GHSA-cchq-frgv-rjh5ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2023-37466ghsaADVISORY
- gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9ghsaWEB
- github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744ghsax_refsource_MISCWEB
- github.com/patriksimek/vm2/releases/tag/v3.10.0ghsax_refsource_MISCWEB
- github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5ghsax_refsource_CONFIRMWEB
- security.netapp.com/advisory/ntap-20230831-0007ghsaWEB
- security.netapp.com/advisory/ntap-20241108-0002ghsaWEB
News mentions
1- vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code ExecutionThe Hacker News · May 7, 2026