CVE-2021-23555: VM2 Project VM2

Critical severity, CVSS 9.8. EPSS: 2.9% chance of exploitation in the next 30 days.

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

Affected products

• VM2 Project VM2: before 3.9.6 (fixed in 3.9.6)

Published 2022-02-11. Last modified 2026-06-17.