CVE-2023-29017

Katalog CVE

CVSS 9.8 · Critical EPSS 63,2%

Kerentanan Improper Control of Dynamically-Managed Code Resources pada vm2 project vm2. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.

Rincian

Terbit di NVD

6 April 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-913: Improper Control of Dynamically-Managed Code Resources

EPSS (30 hari)

63,2% peluang dieksploitasi; lebih tinggi dari 99,1% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv advisory vendor
• https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50 patch
• https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d exploit
• https://github.com/patriksimek/vm2/issues/515 exploit · issue tracking