{"vulnerability": "CVE-2023-37466", "sightings": [{"uuid": "21e36b89-b040-493c-9ddd-9e7e3ef72f27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://t.me/ctinow/177684", "content": "https://ift.tt/oO9Y4mZ\nCVE-2023-37466 Exploit", "creation_timestamp": "2024-02-01T17:16:30.000000Z"}, {"uuid": "4946eb4c-eb3f-4440-900d-af031ebdae42", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://t.me/cibsecurity/66711", "content": "\u203c CVE-2023-37466 \u203c\n\nvm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code. Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2023-07-14T07:11:58.000000Z"}, {"uuid": "7ab01b0b-6f12-47d7-89ba-c295cfbe498d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://bsky.app/profile/euvd-bot.bsky.social/post/3ml2azcq27d2c", "content": "\ud83d\udea8 EUVD-2026-26986\n\ud83d\udcca 9.8/10\n\ud83c\udfe2 patriksimek\n\n\ud83d\udcdd vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing att...\n\n\ud83d\udd17 https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-26986\n\n#cybersecurity #infosec #cve #euvd", "creation_timestamp": "2026-05-04T18:03:14.785539Z"}, {"uuid": "f96fd294-6858-489b-8f07-600b1931dc60", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2ckkquyt2l", "content": "\ud83d\udd34 CVE-2026-24120 - Critical (9.8)\n\nvm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-24120/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-05-04T18:30:48.671010Z"}, {"uuid": "7d81a0e6-3bbf-4e17-b8d7-8bbc2eaa9def", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mlicivo2zc2f", "content": "\ud83d\udccc CVE-2026-24120 - vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing att... https://www.cyberhub.blog/cves/CVE-2026-24120", "creation_timestamp": "2026-05-10T08:07:08.195096Z"}, {"uuid": "988dacb1-18bb-4d76-b62b-0349341fdf39", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2023-37466", "type": "published-proof-of-concept", "source": "https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5", "content": "", "creation_timestamp": "2023-07-12T12:40:24.000000Z"}, {"uuid": "234269d1-0152-4d87-8e9b-12543b297560", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mv3b5dfncn24", "content": "CVE-2023-37466 - vm2\nvm2, a Node.js library, has critical security issues that could let hackers run unauthorized code. This could happen if you're using an outdated version of vm2. Update to version\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#vm2 #rootio #Rootnpm #CVE #infosec", "creation_timestamp": "2026-09-09T09:50:05.472110Z"}, {"uuid": "504cf276-cd06-4345-97ec-1a4899203845", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://t.me/shimiscyberworld/1180", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-24120 \u2014 CVSS 9.8\nCVE-2026-24120: vm2 Sandbox Escape Allows Host Command Execution\n\nCVE-2026-24120 \u2014 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to wri\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-24120 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-12T10:00:18.048918Z"}, {"uuid": "82f2f9cd-5796-4cab-9a5a-709882ff1787", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2023-37466", "type": "seen", "source": "https://t.me/shimiscyberworld/1180", "content": "\ud83d\udee1\ufe0f SCW \u2502 Critical Vulnerability\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\n\u26a0\ufe0f CVE-2026-24120 \u2014 CVSS 9.8\nCVE-2026-24120: vm2 Sandbox Escape Allows Host Command Execution\n\nCVE-2026-24120 \u2014 vm2 is an open source vm/sandbox for Node.js. Prior to version 3.10.5, the fix for CVE-2023-37466 is insufficient and can be circumvented allowing attackers to wri\n\n\ud83d\udd34 Critical \u00b7 3 ATT&CK techniques mapped\n\n#cve  #critical  #high_severity\n\n\ud83d\udcd6 Full analysis + IOCs \u2192\n\ud83c\udfaf Type /detect cve-2026-24120 in the bot\nOpen Intel Bot \u2192\n\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n\ud83c\udf10 @shimiscyberworld \u00b7 shimiscyberworld.com", "creation_timestamp": "2026-09-13T00:00:09.730920Z"}]}