Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2023-30547 EUVD-2023-1268GHSA-ch3r-j5x3-6q2m

Sandbox Escape in vm2

Published Apr 17, 2023 · Updated Feb 5, 2025 · Assigned by GitHub_M

Vendor: patriksimek Product: vm2 Package: vm2 Ecosystem: npm

Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Affected products

VendorProductAffectedFixed
patriksimek vm2 < 3.9.17 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 5 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
npm vm2 < 3.9.17 3.9.17 GHSA-ch3r-j5x3-6q2m

Advisories 1

References