vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host

CRITICAL 10.0CVE-2022-36067 · GHSA-mrgp-mrhc-5jrq · Published 06/09/2022 · updated 17/06/2026

Package	Affected versions	Patched versions
vm2 vm2_project	`< 3.9.11`	`3.9.11`
vm2 npm	`< 3.9.11`	`3.9.11`

Description

Impact

A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

Patches

This vulnerability was patched in the release of version 3.9.11 of vm2

Workarounds

None.

References

Github Issue - https://github.com/patriksimek/vm2/issues/467 The file that was patched - https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71 The commit with the patch - https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164

For more information

If you have any questions or comments about this advisory:

Open an issue in VM2

NVD description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

References

patriksimek/vm2 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2022-36067 · ADVISORY
patriksimek/vm2 · WEB
patriksimek/vm2 commit d9a7f3c · WEB
patriksimek/vm2 · PACKAGE
patriksimek/vm2 · WEB
security.netapp.com/advisory/ntap-20221017-0002 · WEB
oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067 · WEB
security.netapp.com/advisory/ntap-20221017-0002 · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free