Most recent entries from all

bdu:2023-01956

certfr-2023-avi-0597 — De multiples vulnérabilités ont été découvertes dans IBM Cognos Analytics. Certaines d'entr…

certfr-2023-avi-0597

EUVD-2026-214384

fkie_cve-2023-29017

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.

GHSA-7jxr-cg7f-gpgv — vm2 vulnerable to sandbox escape

Affected: npm: vm2

vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors.

- vm2 version: ~3.9.14 - Node version: 18.15.0, 19.8.1, 17.9.1

### Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches This vulnerability was patched in the release of version `3.9.15` of `vm2`.

### Workarounds None.

gsd-2023-29017

RHSA-2023:1893 — Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.0 hotfix security update for console

vm2: sandbox escape vm2: Sandbox Escape vm2: Sandbox Escape when exception sanitization

WID-SEC-W-2023-1004 — vm2: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um aus der Sandbox auszubrechen und beliebigen Code im Host-Kontext auszuführen.