CVE-2022-36067: vm2 vulnerable to Sandbox Escape before v3.9.11

Published Sep 6, 2022
·
Updated

A flaw was found in the vm2 sandbox when running untrusted code, as the sandbox setup does not manage proper exception handling. This flaw allows an attacker to bypass the sandbox protections and gain remote code execution on the hypervisor host or the host which is running the sandbox.

Other sources

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

Affected Software

2 affected componentsFixes available
redhat/vm2<3.9.11
3.9.11
Vm2 Project Vm2 Node.js<3.9.11

Remediation

Information

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.

Event History

Sep 6, 2022
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
DescriptionSeverityWeakness
Sep 7, 2022
Data Sourced
12:00 AM
RemedyDescriptionSeverityWeaknessAffected Software
Jan 27, 2026
News Published
via BleepingComputer·04:35 PM
News Published
via BleepingComputer·04:36 PM
May 6, 2026
News Published
via BleepingComputer·06:38 PM

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

What is the severity of CVE-2022-36067?

CVE-2022-36067 has been assigned a high severity rating due to the potential for remote code execution.

2

How do I fix CVE-2022-36067?

To mitigate CVE-2022-36067, upgrade vm2 to version 3.9.12 or later, where the vulnerability has been addressed.

3

Who is affected by CVE-2022-36067?

CVE-2022-36067 affects all versions of vm2 prior to 3.9.12 when running untrusted code.

4

What type of vulnerability is CVE-2022-36067?

CVE-2022-36067 is categorized as a sandbox bypass vulnerability, allowing execution of untrusted code on the host.

5

Can CVE-2022-36067 be exploited remotely?

Yes, CVE-2022-36067 can be exploited remotely, allowing an attacker to execute code on the hypervisor host.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203