Detections
Analytics
SCA: security update for vm2 (GHSA-xj72-wvfv-8985)
critical Tenable Cloud Security Plugin ID 420544
Description
There are packages installed that are affected by a vulnerability referenced in the following CVE:- There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions
up to 3.9.15, allowing attackers to bypass `handleException()` and leak unsanitized host exceptions which
can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the
sandbox protections to gain remote code execution rights on the host running the sandbox. This
vulnerability was patched in the release of version `3.9.16` of `vm2`. (CVE-2023-29199)
See Also
Plugin Details
Severity: Critical
ID: 420544
Version: Revision 1.6
Type: Local
Family: SCA Checks
Published: 1/23/2025
Updated: 7/2/2026
Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security
Risk Information
VPR
Risk Factor: High
Score: 7
Percentile: 98.33
Vendor
Vendor Severity: Critical
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2023-29199
CVSS v3
Risk Factor: Critical
Base Score: 10
Temporal Score: 9
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
Vulnerability Information
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 4/12/2023
Vulnerability Publication Date: 4/12/2023
Reference Information
CVE: CVE-2023-29199
cwe: CWE-913