CVE-2022-36067: vm2 Sandbox Escape Remote Code Execution
Summary
CVE-2022-36067: vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host. Affects vm2 versions < 3.9.11. Fixed in 3.9.11. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is an npm package that provides a sandboxed environment for executing JavaScript code. It is commonly used for running untrusted code securely. However, a vulnerability has been discovered in vm2 that allows a threat actor to bypass the sandbox protections and gain remote code execution rights on the host running the sandbox.
Vulnerability Detail
The vulnerability in vm2 allows an attacker to escape the sandbox and execute arbitrary code on the host system. By exploiting this vulnerability, an attacker can bypass the security measures put in place by the sandbox and gain full control over the host system. This can lead to various malicious activities, including unauthorized access, data theft, and further compromise of the host environment.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.11
This is the first release that contains the fix.
npm install vm2@3.9.11Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update the vm2 package to the patched version to mitigate the risk of sandbox escape and remote code execution.
Conclusion
The vm2 package is vulnerable to a sandbox escape vulnerability that allows remote code execution on the host system. To mitigate this risk, it is crucial to update the package to version 3.9.11 or later. Failure to address this vulnerability can result in unauthorized access and compromise of the host environment. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vm2 →
FAQ
vm2 is an npm package that provides a sandboxed environment for executing JavaScript code. It is commonly used for running untrusted code securely.
The vulnerability allows an attacker to escape the sandbox and execute arbitrary code on the host system, leading to potential unauthorized access, data theft, and further compromise of the host environment.
To fix this vulnerability, update the vm2 package to version 3.9.11 or later, which includes the necessary patches to mitigate the sandbox escape vulnerability.
No, there are no known workarounds for this vulnerability. Updating the vm2 package to the patched version is the recommended solution.
For more information, you can refer to the GitHub issue at https://github.com/patriksimek/vm2/issues/467
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
