There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.
CVE-2023-29199 - Critical Severity Vulnerability
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.8.1.tgz
Path to dependency file: /backend/package.json
Path to vulnerable library: /backend/node_modules/vm2/package.json
Dependency Hierarchy: - :x: **vm2-3.8.1.tgz** (Vulnerable Library)
Found in HEAD commit: 50731d7b248d2728e4e5fda6648192e5a322f08c
Found in base branch: master
There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.16` of `vm2`.
Publish Date: 2023-04-14
URL: CVE-2023-29199
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985
Release Date: 2023-04-14
Fix Resolution: 3.9.16