Vulnerability in Patriksimek Vm2
CVE-2023-29017
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.632 (99.2th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.632 · newest: 0.632 · change: 0.000
Affected products
- Patriksimek Vm2 — versions < 3.9.15
- Vm2 Project
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv (Vendor Advisory)
- github.com/patriksimek/vm2/issues/515 (Exploit, Issue Tracking)
- github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50 (Patch)
- gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d (Exploit)
Frequently asked questions
- What is CVE-2023-29017?
- CVE-2023-29017 is a critical-severity vulnerability in Patriksimek Vm2, classified under Improper Control of Dynamically-Managed Code Resources. CVSS score: 10.0/10. Published 2023-04-06.
- How severe is CVE-2023-29017?
- Critical severity. CVSS v3 base score is 10.0 out of 10.
- Is CVE-2023-29017 known to be exploited?
- 17 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.