Description
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, by combining Buffer.call.call({}.__lookupGetter__, Buffer, "__proto__"), Buffer.call.call({}.__lookupSetter__, Buffer, "__proto__"), and Node.js's ERR_INVALID_ARG_TYPE Error, the host's TypeError constructor can be obtained, which allows the escape from the sandbox. This allows attackers to run arbitrary code. This issue has been patched in version 3.11.4.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/patriksimek/vm2/security/advisories/GHSA-v6mx-mf47-r5wg
X_Refsource_Misc x_refsource_misc
https://github.com/patriksimek/vm2/commit/27c525f4615e2b983f122e2bed327d810126f5c8
X_Refsource_Misc x_refsource_misc
https://github.com/patriksimek/vm2/releases/tag/v3.11.4
Scores
CVSS v3
10.0
EPSS
0.0070
EPSS Percentile
48.2%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-913
Status
published
Products (2)
npm/vm2
0 - 3.11.4npm
patriksimek/vm2
< 3.11.4
Published
Jun 12, 2026
Tracked Since
Jun 12, 2026