QwikSec

Security Database

CVE

CWE

Training

CVE-2022-36067

Published: Sep 6, 2022

Modified: Apr 22, 2025

PUBLISHED

CVSS v3.1

10.0

CRITICAL

Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Vendor	Product	Versions
patriksimek	vm2	affected `< 3.9.11`

Weaknesses (CWE)

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

References

https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq

https://github.com/patriksimek/vm2/issues/467

https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164

https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71

https://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067

https://security.netapp.com/advisory/ntap-20221017-0002/

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.