CVE-2022-36067

CRITICAL

vm2 <3.9.11 - Remote Code Execution

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2022-36067. PoCs published by Prathamrajgor, 0x1nsomnia.

AI-analyzed exploit summary This repository contains a functional exploit for CVE-2022-36067, leveraging a prototype pollution vulnerability in the vm2 sandbox to achieve remote code execution (RCE). The exploit manipulates the Error object's prepareStackTrace method to bypass sandbox restrictions and execute arbitrary commands.

Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Exploits (2)

nomisec WORKING POC 7 stars
by Prathamrajgor · poc
https://github.com/Prathamrajgor/Exploit-For-CVE-2022-36067

This repository contains a functional exploit for CVE-2022-36067, leveraging a prototype pollution vulnerability in the vm2 sandbox to achieve remote code execution (RCE). The exploit manipulates the Error object's prepareStackTrace method to bypass sandbox restrictions and execute arbitrary commands.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vm2 (versions < 3.9.11)
No auth needed
Prerequisites: Node.js environment with vulnerable vm2 version installed
devstral-2 · analyzed Feb 18, 2026 Full analysis →
nomisec WORKING POC 2 stars
by 0x1nsomnia · poc
https://github.com/0x1nsomnia/CVE-2022-36067-vm2-POC-webapp

This repository contains a functional proof-of-concept exploit for CVE-2022-36067, a vulnerability in the vm2 sandbox library. The exploit demonstrates remote code execution (RCE) by allowing users to upload and execute arbitrary JavaScript code in a vm2 sandbox via a web interface.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vm2 (version 3.9.3)
No auth needed
Prerequisites: Node.js environment · vm2 library installed (version 3.9.3)
devstral-2 · analyzed Feb 18, 2026 Full analysis →

Scores

CVSS v3 10.0
EPSS 0.8447
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-913
Status published
Products (2)
npm/vm2 0 - 3.9.11npm
vm2_project/vm2 < 3.9.11
Published Sep 06, 2022
Tracked Since Feb 18, 2026