p PatchFirst

CVE-2023-30547

CVE-2023-30547 · Sandbox Escape in vm2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

CVSS 9.8 · Critical · EPSS 73.0% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • < 3.9.17: Affected

    No fix published

  • vm2 npm

    Affected ranges
    • SEMVER: < 3.9.17

    Update to 3.9.17

Original sources

Check your server →