Patchfirst
Patchfirst
Chainpatriksimek · vm2npm:vm2

patriksimek vm2: incomplete fixes (2021–2026)

9 CVEs over 4 generations, 18 Oct 2021 to 4 May 2026.

Family tree

Left to right by publication date.Oldest first. Select a CVE to open it.
  1. CVE-2021-2344918 Oct 2021 First in the chain
  2. CVE-2021-2355511 Feb 2022 related to CVE-2021-23449
  3. CVE-2022-360676 Sep 2022 No direct link to an earlier CVE
  4. CVE-2023-290176 Apr 2023 next fix after CVE-2022-36067
  5. CVE-2023-2919914 Apr 2023 related to CVE-2021-23555next fix after CVE-2023-29017
  6. CVE-2023-3054717 Apr 2023 related to CVE-2023-29199related to CVE-2021-23555
  7. CVE-2023-3231315 May 2023 related to CVE-2021-23555next fix after CVE-2023-30547
  8. CVE-2023-3746613 Jul 2023 related to CVE-2021-23555related to CVE-2022-36067
  9. CVE-2026-241204 May 2026 incomplete fix for CVE-2023-37466
202120222023202420252026 CVE-2021-23449 → CVE-2021-23555: related (high confidence)CVE-2022-36067 → CVE-2023-29017: Next fix in the same package (high confidence)CVE-2023-29199 → CVE-2023-30547: related (high confidence)CVE-2023-37466 → CVE-2026-24120: incomplete fix (high confidence)CVE-2021-23555 → CVE-2023-29199: related (medium confidence)CVE-2021-23555 → CVE-2023-30547: related (medium confidence)CVE-2021-23555 → CVE-2023-32313: related (medium confidence)CVE-2021-23555 → CVE-2023-37466: related (medium confidence)CVE-2022-36067 → CVE-2023-37466: related (medium confidence)CVE-2023-29017 → CVE-2023-29199: Next fix in the same package (low confidence)CVE-2023-30547 → CVE-2023-32313: Next fix in the same package (low confidence) CVE-2021-23449 18 Oct 2021 CVE-2021-23555 11 Feb 2022 CVE-2022-36067 6 Sep 2022 CVE-2023-29017 6 Apr 2023 CVE-2023-29199 14 Apr 2023 CVE-2023-30547 17 Apr 2023 CVE-2023-32313 15 May 2023 CVE-2023-37466 13 Jul 2023 CVE-2026-24120 4 May 2026 202120222023202420252026 CVE-2021-23449 → CVE-2021-23555: related (high confidence)CVE-2022-36067 → CVE-2023-29017: Next fix in the same package (high confidence)CVE-2023-29199 → CVE-2023-30547: related (high confidence)CVE-2023-37466 → CVE-2026-24120: incomplete fix (high confidence)CVE-2021-23555 → CVE-2023-29199: related (medium confidence)CVE-2021-23555 → CVE-2023-30547: related (medium confidence)CVE-2021-23555 → CVE-2023-32313: related (medium confidence)CVE-2021-23555 → CVE-2023-37466: related (medium confidence)CVE-2022-36067 → CVE-2023-37466: related (medium confidence)CVE-2023-29017 → CVE-2023-29199: Next fix in the same package (low confidence)CVE-2023-30547 → CVE-2023-32313: Next fix in the same package (low confidence) CVE-2021-23449 18 Oct 2021 CVE-2021-23555 11 Feb 2022 CVE-2022-36067 6 Sep 2022 CVE-2023-29017 6 Apr 2023 CVE-2023-29199 14 Apr 2023 CVE-2023-30547 17 Apr 2023 CVE-2023-32313 15 May 2023 CVE-2023-37466 13 Jul 2023 CVE-2026-24120 4 May 2026
Exploited in the wild (CISA KEV) Not in KEV Priority score (0 to 100) High confidence Medium Low

CVEs in this family

Table view of the tree
CVEPublishedTitleLinked fromPriority
CVE-2021-23449 18 Oct 2021 Sandbox Bypass · fixed in 3.9.4 First in chain 24.7
CVE-2021-23555 11 Feb 2022 Sandbox Bypass · fixed in 3.9.6 CVE-2021-23449 · related · High 24.2
CVE-2022-36067 6 Sep 2022 vm2 vulnerable to Sandbox Escape before v3.9.11 · fixed in 3.9.11 First in chain 31.8
CVE-2023-29017 6 Apr 2023 vm2 Sandbox Escape vulnerability · fixed in 3.9.15 CVE-2022-36067 · Next fix in the same package · High 31.8
CVE-2023-29199 14 Apr 2023 vm2 Sandbox escape vulnerability · fixed in 3.9.16 CVE-2021-23555 · related · Medium 24.9
CVE-2023-30547 17 Apr 2023 Sandbox Escape in vm2 · fixed in 3.9.17 CVE-2023-29199 · related · High 31.8
CVE-2023-32313 15 May 2023 Inspect method manipulation in vm2 · fixed in 3.9.18 CVE-2021-23555 · related · Medium 15.0
CVE-2023-37466 13 Jul 2023 vm2 Sandbox Escape vulnerability · fixed in 3.10.0 CVE-2021-23555 · related · Medium 24.9
CVE-2026-24120 4 May 2026 vm2: Sandbox Breakout Through Promise Species · fixed in 3.10.5 CVE-2023-37466 · incomplete fix · High 18.8
↑ ↓ chooseEnter openEsc close