vm2 vulnerable to sandbox escape

NGHIÊM TRỌNG 9.8CVE-2023-29017 · GHSA-7jxr-cg7f-gpgv · Công bố 06/04/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-29017 là lỗ hổng mức NGHIÊM TRỌNG (CVSS 9.8) ảnh hưởng vm2 (vm2 project), vm2.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 63.2%, cao hơn 99.2% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.9.15 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
vm2 vm2_project	`< 3.9.15`	`3.9.15`
vm2 npm	`< 3.9.15`	`3.9.15`

Mô tả

vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors.

vm2 version: ~3.9.14
Node version: 18.15.0, 19.8.1, 17.9.1

Impact

A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

Patches

This vulnerability was patched in the release of version 3.9.15 of vm2.

Workarounds

None.

Mô tả của NVD

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.