@rootio/vm2 vulnerabilities (Root)
94 vulnerabilities.
@rootio/vm2Rootvm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass8.7 High@rootio/vm2Rootvm2 before 3.11.6 Process-wide State Exposure via os and dns10.0 Critical@rootio/vm2Rootvm2: Sandbox Breakout Using Dangerous Host Proto Mutators9.8 Critical@rootio/vm2Rootvm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE9.9 Critical@rootio/vm2Rootvm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike8.7 High@rootio/vm2Rootvm2: NodeVM observability builtins leak host process and HTTP request data6.9 Medium@rootio/vm2Rootvm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server8.6 High@rootio/vm2Rootvm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution10.0 Critical@rootio/vm2Rootvm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass9.8 Critical@rootio/vm2Rootvm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE10.0 Critical@rootio/vm2Rootvm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain8.6 High@rootio/vm2Rootvm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks8.7 High@rootio/vm2Rootvm2: Sandbox Breakout Using Promise Species10.0 Critical@rootio/vm2Rootvm2: Sandbox Escape10.0 Critical@rootio/vm2Rootvm2: Sandbox Breakout Using Async Generator9.8 Critical@rootio/vm2Rootvm2 before 3.11.2 Information Disclosure via Internal State6.9 Medium@rootio/vm2Rootvm2: Sandbox Breakout Through Null Proto Exception9.8 Critical@rootio/vm2Rootvm2 has sandbox breakout via `neutralizeArraySpeciesBatch`9.8 Critical@rootio/vm2Rootvm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution9.1 Critical@rootio/vm2Rootvm2: NodeVM require.root bypass via symlink traversal allows sandbox escape8.5 High@rootio/vm2Rootvm2: Transformer Fast-Path Bypass Exposes Internal State Variable5.3 Medium@rootio/vm2Rootvm2: Host File Path Disclosure via Stack Trace Information Leak5.8 Medium@rootio/vm2Rootvm2: sandbox boundary bypass via host Promise resolution preserving host object identity6.5 Medium@rootio/vm2Rootvm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)7.5 High@rootio/vm2Rootvm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)8.6 High@rootio/vm2Rootvm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escape9.9 Critical@rootio/vm2Rootvm2: Sandbox escape10.0 Critical@rootio/vm2Rootvm2: Sandbox Escape10.0 Critical@rootio/vm2Rootvm2: Sandbox Escape10.0 Critical@rootio/vm2Rootvm2: WASM Sandbox Escape (Node 25 only)9.8 Critical@rootio/vm2Rootvm2: Sandbox Escape9.8 Critical@rootio/vm2Rootvm2: Sandbox Breakout Through Inspect9.8 Critical@rootio/vm2Rootvm2: Sandbox Breakout Through Promise Species9.8 Critical@rootio/vm2RootVM2 Sandbox Breakout Through __lookupGetter__9.8 Critical@rootio/vm2Rootvm2 has a Sandbox Escape9.8 Critical@rootio/vm2Rootvm2 Sandbox Escape vulnerability9.8 Critical@rootio/vm2RootSandbox Escape in vm29.8 Critical@rootio/vm2RootSandbox Escape9.8 Critical@rootio/vm2RootInspect method manipulation in vm25.3 Medium@rootio/vm2RootSandbox Escape in vm29.8 Critical@rootio/vm2Rootvm2 Sandbox escape vulnerability9.8 Critical@rootio/vm2Rootvm2 Sandbox Escape vulnerability10.0 Critical@rootio/vm2RootArbitrary Code Execution9.8 Critical@rootio/vm2Rootvm2 vulnerable to Sandbox Escape before v3.9.1110.0 Critical