Vm2

github.com/patriksimek/vm2 ↗
D
RISKY
15
Total CVEs
14
Crit / High
0
Medium
0%
Unpatched
0%
Patched
9.6
Avg CVSS
0
CISA KEV
// Data sourced from NVD · CISA KEV · RHSA · GHSA · Debian · OSV · EPSS · Exploit-DB How we collect data →
// INTEL UPGRADE
Full Company Dossier — Coming Soon
Executive profiles, financial exposure, M&A risk, breach history & supply-chain threat mapping — all in one place.
OSINT FINANCIALS EXEC PROFILES BREACH DB
▸ CVE Trend by Year
▸ Patch Coverage
Patched
0%
Unpatched
0%
No Status
100%
✓ 0 patched ✗ 0 unpatched
▸ Intelligence by Audience
PoC Available
0 / 20 shown
CISA KEV (Exploited)
0
Shodan Dorks
ssl:"vm2" port:443
org:"Vm2" http.status:200
Top EPSS (Exploitation Probability)
No EPSS data yet for recent CVEs — scores are published by FIRST.org within 24-48h of NVD disclosure.
Quick Facts for Reporting
Total CVEs tracked
15
Critical severity
11
Actively exploited (CISA)
0
Unpatched ratio
0%
Avg CVSS score
9.6
Security grade
D (RISKY)
NVD Data Attribution
Source: NIST National Vulnerability Database (NVD) + GitHub Advisory Database.
Data aggregated by Valters IT Hub · valtersit.com
Last updated: 2026-08-03
Security Risk Score (for investors)
LOW
Vuln Volume
GOOD
Patch Responsiveness
LOW
CISA Exposure
⚠ Not financial advice. Past security incidents do not guarantee future stock performance.
▸ Security News Google News
Critical vm2 Node.js Library Vulnerabilities Enables Arbitrary Code Execution Attacks - CyberSecurityNews
CyberSecurityNews 2026-05-07
Critical Vulnerability in VM2 Sandbox Library for Node.js Let Attackers run Untrusted Code - CyberSecurityNews
CyberSecurityNews 2026-01-28
vm2 Node.js Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution - The Hacker News
The Hacker News 2026-05-07
13 new critical holes in JavaScript sandbox allow execution of arbitrary code - CSO Online
CSO Online 2026-05-07
Critical vm2 Node.js Library Flaws Enable Arbitrary Code Execution Attacks - GBHackers News
GBHackers News 2026-05-07
Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution - The Hacker News
The Hacker News 2026-01-28
▸ Recent CVEs showing 20 of 0
No published CVEs found.
▸Intel
Trust ScoreD — RISKY
Max CVSS10.0
Last Updated2026-08-03
▸Top Weaknesses
CWE-913
Unknown Weakness Type
6 occurrences in Vm2 CVEs (40% of total)
CWE-913 ⓘ
6
CWE-693
Unknown Weakness Type
4 occurrences in Vm2 CVEs (27% of total)
CWE-693 ⓘ
4
CWE-94
Code Injection
3 occurrences in Vm2 CVEs (20% of total)
CWE-94 ⓘ
3
CWE-668
Unknown Weakness Type
1 occurrence in Vm2 CVEs (7% of total)
CWE-668 ⓘ
1
CWE-265
Unknown Weakness Type
1 occurrence in Vm2 CVEs (7% of total)
CWE-265 ⓘ
1
▸Company Profile

Vm2 is a sandbox library for Node.js that allows the execution of untrusted code in a controlled environment. It is widely used in the JavaScript ecosystem for isolating third-party scripts, making it relevant to cybersecurity as a tool for preventing code injection and privilege escalation. The project is maintained by Patrik Šimek and has been associated with multiple CVEs due to sandbox escape vulnerabilities.

▸Response Metrics
Est. MTTR ⓘ ~500 days (Critical)
Mean Time To Remediate. Estimates days from CVE disclosure to patch.
Industry avg: ~60d (good) · 100-300d (poor) · 300d+ (critical)
Patch Speed ⓘ Poor (>65% open)
0% of CVEs still unpatched.  Excellent: <20% · Good: 20-40% · Avg: 40-65% · Poor: >65%
▸ Financial Risk Estimate
Est. GDPR Low
€710K
Est. GDPR High
€7.1M

Based on 11 critical CVEs, 0 CISA KEV, 100% unpatched. Model: GDPR Art.83 · not legal advice.

▸Actions
⚖ Compare with another vendor
▸Embed Badge
Vm2 D valtersit.com