vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version
    3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of
    unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution
    rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of
    vm2. There are no known workarounds. (CVE-2023-29017)

The version of the Node.js module vm2 installed on the remote host is prior to 3.9.15. It is, therefore affected by a sandbox breakout vulnerability. Untrusted code can break out of the sandbox created by the affected vm2 module and execute arbitrary code on the host system.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
412121	SCA: security update for vm2 (GHSA-7jxr-cg7f-gpgv)	Tenable Cloud Security	SCA Checks	Local	critical
412121	SCA: security update for vm2 (GHSA-7jxr-cg7f-gpgv)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
174021	Node.js Module vm2 < 3.9.15 Sandbox Breakout	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2023-29017

critical

Tenable Plugins

critical

critical

critical