CVE-2023-29017 CRITICAL

CVE-2023-29017: vm2 Sandbox Escape vulnerability

Vendor Patriksimek

Product vm2

Weakness CWE-913

Published April 6, 2023

Last update February 10, 2025

View on NVD All CVEs

CVSS base score

10.0/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.

Key dates

02Disclosure timeline

April 6, 2023 CVE published

February 10, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2023-29017 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/913.html

Related vulnerabilities

04Related CVE

CVE-2024-27135 Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution CVE-2026-33286 Graphiti Affected by Arbitrary Method Execution via Unvalidated Relationship Names CVE-2026-34156 NocoBase Affected by Sandbox Escape to RCE via console._stdout Prototype Chain Traversal in Workflow Script Node CVE-2025-14695 SamuNatsu HaloBot Inter-plugin API index.js html_renderer dynamically-managed code resources CVE-2026-47208 vm2: Sandbox Breakout Using Promise Species