vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a
    vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an
    unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run
    arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of
    `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
    (CVE-2023-30547)

There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
413906	SCA: security update for vm2 (GHSA-ch3r-j5x3-6q2m)	Tenable Cloud Security	SCA Checks	critical
413906	SCA: security update for vm2 (GHSA-ch3r-j5x3-6q2m)	Tenable Self-Hosted Container Security	SCA Checks	critical
181413	Node.js Module vm2 < 3.9.17 Sandbox Breakout	Nessus	Misc.	critical

Detections

Analytics

CVE-2023-30547

critical

Tenable Plugins

critical

critical

critical