Most recent entries from all

bdu:2023-02869

EUVD-2026-211445

fkie_cve-2023-32314

vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

GHSA-whpj-8f3w-67p5 — vm2 Sandbox Escape vulnerability

Affected: npm: vm2

A sandbox escape vulnerability exists in vm2 for versions up to 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`.

### Impact A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.

### Patches This vulnerability was patched in the release of version `3.9.18` of `vm2`.

### Workarounds None.

### References PoC - https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac

### For more information

If you have any questions or comments about this advisory:

- Open an issue in [VM2](https://github.com/patriksimek/vm2)

Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.

gsd-2023-32314

RHSA-2023:3325 — Red Hat Security Advisory: Multicluster Engine for Kubernetes 2.1.7 security fixes and container updates

vm2: Inspect Manipulation vm2: Sandbox Escape

WID-SEC-W-2023-1217 — vm2: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um beliebigen Programmcode auszuführen und um Dateien zu manipulieren.