CVE-2022-36067 CRITICAL

CVE-2022-36067: vm2 vulnerable to Sandbox Escape before v3.9.11

Vendor Patriksimek
Product vm2
Weakness CWE-913
Published September 6, 2022
Last update April 22, 2025
View on NVD All CVEs

CVSS base score

10.0/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Key dates

02Disclosure timeline

September 6, 2022 CVE published
April 22, 2025 Record updated