All vm2 CVEs — Complete Vulnerability History
vm2 is a popular Node.js sandbox library for executing untrusted code safely. It has had multiple critical sandbox escape vulnerabilities. The maintainers recommend migrating to isolated-vm for production use.
npm
5M+ weekly downloads
4 CVEs total
4 CRITICAL
🔴 CISA KEV
CVE history — all 4 known vulnerabilities
🔴 1 CVE on CISA KEV — actively exploited in real attacks
| CVE ID | Year | Severity | Description | Fix |
|---|---|---|---|---|
| CVE-2022-36067 | 2022 | CRITICAL | Sandbox escape via Error.prepareStackTrace | Fixed in 3.9.11 |
| CVE-2023-29017 | 2023 | 🔴CRITICAL | Sandbox escape via Promise handler — CISA KEV | Fixed in 3.9.19 |
| CVE-2023-29199 | 2023 | CRITICAL | Sandbox escape via exception sanitisation | Fixed in 3.9.17 |
| CVE-2023-30547 | 2023 | CRITICAL | Sandbox escape via argument handling | Fixed in 3.9.19 |
Current safe version
✓ Update to 3.9.19
The latest safe version addresses all 4 known CVEs listed above.
Before and after
Vulnerable:
"vm2": "3.9.15"
Fixed:
"vm2": "3.9.19"
Then run: npm install
Paste your manifest — see your exact installed version against this full CVE list.
Scan with PackageFix →Free · No signup · No CLI · Runs in your browser
Common questions
Is vm2 safe to use for running untrusted code?
The maintainers themselves say no — after the repeated sandbox escapes in 2023, they recommend migrating to isolated-vm, which uses V8 isolates for stronger isolation. vm2 3.9.19 patches the known escapes but the fundamental architecture has proven difficult to secure fully.
What's the difference between vm2 and Node.js's built-in vm module?
Node's built-in vm module provides no security isolation — it's explicitly not a sandbox. vm2 was created to add security boundaries, but has had repeated escapes. isolated-vm and container-based solutions (Docker sandbox) provide stronger guarantees.
Why does vm2 keep getting sandbox escape CVEs?
Sandboxing a dynamic language at the library level in the same process is fundamentally hard. Every CVE reveals a new JavaScript primitive that the sandbox didn't account for — Proxies, Promise handlers, Error stack traces. The attack surface is very large.
CVE-2023-29017 is CVSS 10.0 — should I stop using vm2 immediately?
Yes — update to 3.9.19 immediately to patch the known CVEs, then plan a migration to isolated-vm or a process-level sandbox. Running vm2 < 3.9.19 in production with untrusted code input is a critical risk.