CVE-2023-29017
10.0
CRITICAL · CVSS 3.1 · EPSS 63.2% (pctl 99)
Patch early
EPSS 63.2% — above the 10% action threshold.
Description
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Scoring
| CVSS | 10.0 (CRITICAL, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 63.19% — more likely to be exploited than 99% of all CVEs |
| Weakness | CWE-913 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2023-04-06 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| vm2 project | vm2 |
References
- https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d
- https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50
- https://github.com/patriksimek/vm2/issues/515
- https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv
- https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d
- https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50
- https://github.com/patriksimek/vm2/issues/515
- https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv
→ the Explorer · watch your stack · NVD