CVE-2023-37466

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.

• CWE-94
• CWE-94

• https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
• https://github.com/patriksimek/vm2/releases/tag/v3.10.0
• https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5Exploit, Vendor Advisory
• https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5Exploit, Vendor Advisory
• https://security.netapp.com/advisory/ntap-20241108-0002/

Published

Jul 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-3746The ActivityPub WordPress plugin before 1.0.0 does not sanit…5.4
• CVE-2023-37460Plexis Archiver is a collection of Plexus components to crea…9.8
• CVE-2023-37461Metersphere is an opensource testing framework. Files upload…9.8
• CVE-2023-37462XWiki Platform is a generic wiki platform offering runtime s…8.8
• CVE-2023-37463cmark-gfm is an extended version of the C reference implemen…7.5
• CVE-2023-37464OpenIDC/cjose is a C library implementing the Javascript Obj…7.5
• CVE-2023-37467Discourse is an open source discussion platform. Prior to ve…5.4
• CVE-2023-37468Feedbacksystem is a personalized feedback system for student…5.5
• CVE-2023-37469CasaOS is an open-source personal cloud system. Prior to ver…8.8
• CVE-2023-3747Zero Trust Administrators have the ability to disallow end u…5.5
• CVE-2023-37470Metabase is an open-source business intelligence and analyti…9.8
• CVE-2023-37471Open Access Management (OpenAM) is an access management solu…9.8