cve.bz

CVE-2022-36067

10.0 criticalEPSS 48%

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Severity

CVSS 3.1

10.0 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS
48% chance of exploitation in the next 30 days; higher than 98% of CVEs (scores of 2026-10-31)
CWE
CWE-913
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-mrgp-mrhc-5jrqnpmvm2<3.9.113.9.11

References

Check your stackJSON