vm2 vulnerable to Inspect Manipulation

TRUNG BÌNH 5.3CVE-2023-32313 · GHSA-p5gc-c584-jj6v · Công bố 15/05/2023 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2023-32313 là lỗ hổng mức TRUNG BÌNH (CVSS 5.3) ảnh hưởng vm2 (vm2 project), vm2.
Xác suất bị khai thác trong 30 ngày tới (EPSS): 0.79%, cao hơn 56.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 3.9.18 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
vm2 vm2_project	`< 3.9.18`	`3.9.18`
vm2 npm	`< 3.9.18`	`3.9.18`

Mô tả

In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log.

Impact

A threat actor can edit options for console.log.

Patches

This vulnerability was patched in the release of version 3.9.18 of vm2.

Workarounds

After creating a vm make the inspect method readonly with vm.readonly(inspect).

References

PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550

For more information

If you have any questions or comments about this advisory:

Open an issue in VM2

Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.

Mô tả của NVD

vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.