CriticalGHSA-7jxr-cg7f-gpgvCVE-2023-29017
vm2 vulnerable to sandbox escape
Published 7 Apr 2023 · Updated 10 Sept 2026
Affected package
vm2npm
- Affected
- <3.9.15
- Fixed in
- 3.9.15
Update to the fixed version for your release line, for example:
npm install vm2@3.9.15Details
vm2 was not properly handling host objects passed to Error.prepareStackTrace in case of unhandled async errors.
- vm2 version: ~3.9.14
- Node version: 18.15.0, 19.8.1, 17.9.1
Impact
A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox.
Patches
This vulnerability was patched in the release of version 3.9.15 of vm2.
Workarounds
None.
Is GHSA-7jxr-cg7f-gpgv in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected vm2, and gives you the command that fixes it.
References
- Linkgithub.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv
- Advisorynvd.nist.gov/vuln/detail/CVE-2023-29017
- Linkgithub.com/patriksimek/vm2/issues/515
- Linkgithub.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50
- Linkgist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d
- Packagegithub.com/patriksimek/vm2
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.