cve/2021/CVE-2021-23555.md

### [CVE-2021-23555](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23555)
![](https://img.shields.io/static/v1?label=Product&message=vm2&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Sandbox%20Bypass&color=brightgreen)

### Description

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

### POC

#### Reference
- https://snyk.io/vuln/SNYK-JS-VM2-2309905

#### Github
- https://github.com/ARPSyndicate/cvemon
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00			`### [CVE-2021-23555](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23555)`
			`![](https://img.shields.io/static/v1?label=Product&message=vm2&color=blue)`
Update CVE list 2025-09-29 21:09 2025-09-29 21:09:30 +02:00			`![](https://img.shields.io/static/v1?label=Version&message=unspecified%20&color=brightgreen)`
			`![](https://img.shields.io/static/v1?label=Vulnerability&message=Sandbox%20Bypass&color=brightgreen)`
Update Sat May 25 21:48:12 CEST 2024 2024-05-25 21:48:12 +02:00
			`### Description`

			`The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.`

			`### POC`

			`#### Reference`
			`- https://snyk.io/vuln/SNYK-JS-VM2-2309905`

			`#### Github`
			`- https://github.com/ARPSyndicate/cvemon`