{"resultsPerPage":1,"startIndex":0,"totalResults":1,"format":"NVD_CVE","version":"2.0","timestamp":"2026-04-16T22:55:41.625","vulnerabilities":[{"cve":{"id":"CVE-2023-37466","sourceIdentifier":"security-advisories@github.com","published":"2023-07-14T00:15:09.263","lastModified":"2026-01-05T22:15:46.563","vulnStatus":"Modified","cveTags":[],"descriptions":[{"lang":"en","value":"vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue."},{"lang":"es","value":"vm2 es una máquina virtual/sandbox avanzada para Node.js. La librería contiene problemas de seguridad críticos y no debe usarse para producción. El mantenimiento del proyecto ha sido descontinuado. En vm2 para versiones hasta 3.9.19, la sanitización del controlador `Promise` se puede omitir con la propiedad de acceso `@@species`, lo que permite a los atacantes escapar del entorno limitado y ejecutar código arbitrario, lo que potencialmente permite la ejecución remota de código dentro del contexto del entorno limitado de vm2."}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":9.8,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":5.9},{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","baseScore":10.0,"baseSeverity":"CRITICAL","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"CHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":6.0}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-94"}]},{"source":"nvd@nist.gov","type":"Primary","description":[{"lang":"en","value":"CWE-94"}]}],"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*","versionEndIncluding":"3.9.19","matchCriteriaId":"5F54A6F9-FD6B-4E23-A6B7-616952129C1C"}]}]}],"references":[{"url":"https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744","source":"security-advisories@github.com"},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.10.0","source":"security-advisories@github.com"},{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","source":"security-advisories@github.com","tags":["Exploit","Vendor Advisory"]},{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","source":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20241108-0002/","source":"af854a3a-2127-422b-91ae-364da2661108"}]}}]}