Vulnerability in Patriksimek Vm2
CVE-2023-29017
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
EPSS: 0.632 (99.1th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Patriksimek Vm2 — versions < 3.9.15
- Vm2_project Vm2
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
- security-advisories@github.com (Exploit, x_refsource_MISC, Issue Tracking)
- security-advisories@github.com (Patch, x_refsource_MISC)
- security-advisories@github.com (Exploit, x_refsource_MISC)
Frequently asked questions
- What is CVE-2023-29017?
- CVE-2023-29017 is a critical-severity vulnerability in Patriksimek Vm2, classified under Improper Control of Dynamically-Managed Code Resources. CVSS score: 10.0/10. Published 2023-04-06.
- How severe is CVE-2023-29017?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2023-29017 known to be exploited?
- 17 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.