CVE-2023-29017

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Prior to version 3.9.15, vm2 was not properly handling host objects passed to `Error.prepareStackTrace` in case of unhandled async errors. A threat actor could bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.15 of vm2. There are no known workarounds.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-913

Affected software

No affected versions have been published.

Timeline

Published
Apr 6, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-290188.8The OpenFeature Operator allows users to expose feature flags to applications. Assuming the pre-existence of a vulnerability that allows forCVE-2023-290198.1@fastify/passport is a port of passport authentication library for the Fastify ecosystem. Applications using `@fastify/passport` in affectedCVE-2023-29026.5A vulnerability was found in NFine Rapid Development Platform 20230511. It has been rated as problematic. Affected by this issue is some unkCVE-2023-290206.5@fastify/passport is a port of passport authentication library for the Fastify ecosystem. The CSRF (Cross-Site Request Forger) protection enCVE-2023-290225.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290236.1A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a malicious CVE-2023-290246.5A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product A cross site scripting vulnerability waCVE-2023-290255.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290265.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290275.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290285.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciouCVE-2023-290295.9A cross site scripting vulnerability was discovered in Rockwell Automation's ArmorStart ST product that could potentially allow a maliciou
CVE-2023-29017: Critical severity, CVSS 9.8 | Vulnix