CVE-2022-36067: vm2 sandbox escape allows remote code execution on host

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 10.0 with network reachability, no authentication or interaction, scope change, and public exploit references make this a maximum-severity sandbox escape.

What it is

vm2, a Node.js sandbox for running untrusted code with whitelisted built-in modules, fails to properly control dynamically-managed code, letting a threat actor bypass sandbox protections. Versions prior to 3.9.11 are affected, and the flaw is patched only in 3.9.11 with no known workarounds. Because vm2 is used specifically to contain untrusted code, a sandbox escape undermines the core security guarantee of any application relying on it.

Impact

An attacker gains remote code execution on the host running the sandbox, escaping the isolation boundary and running arbitrary code with the privileges of the Node.js process. This can lead to full compromise of the host and any data or credentials it can reach.

Attack surface

The flaw is network-reachable (AV:N) with no privileges or user interaction required (PR:N/UI:N), meaning any path that feeds attacker-controlled code into the vm2 sandbox is a viable entry point. The scope change (S:C) reflects that the impact crosses from the sandbox into the host environment.

Exploitation

CVE-2022-36067 is not listed in CISA KEV, but EPSS is high at roughly 0.479 (98.8th percentile), and multiple references are tagged Exploit, including a public write-up, indicating exploit code and technical detail are publicly available.

What to do

• Upgrade vm2 to version 3.9.11 or later; this is the only fix and there are no known workarounds.
• If immediate upgrade is not possible, remove or disable vm2-based execution of untrusted code until patched.
• Audit applications and dependencies that embed vm2 to confirm which instances run untrusted input and prioritize those for patching.
• Run Node.js processes that use vm2 with least privilege and restrict outbound network and filesystem access to limit post-exploitation impact.
• Track vendor advisories (for example NetApp) for downstream products that bundle the affected vm2 version.

Detection

• Monitor for unexpected child processes, shell execution, or outbound connections spawned by Node.js processes that use vm2.
• Alert on anomalous file writes or reads by Node.js service accounts outside expected application paths.
• Review application logs for sandbox errors or unusual module loading patterns preceding suspicious process activity.
• Inventory running Node.js services and check installed vm2 versions against 3.9.11 to find unpatched instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.