CVE-2023-32314

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Vendor	Product	Versions
patriksimek	vm2	< 3.9.18

References

https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5acExploit, Third Party Advisory
https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912dafPatch
https://github.com/patriksimek/vm2/releases/tag/3.9.18Release Notes
https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5Vendor Advisory
https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5acExploit, Third Party Advisory
https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912dafPatch
https://github.com/patriksimek/vm2/releases/tag/3.9.18Release Notes
https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5Vendor Advisory

Timeline

Published: May 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-323157.5Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was fo CVE-2023-323164.3CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplor CVE-2023-323177.2Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS chea CVE-2023-323186.7Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app prevente CVE-2023-323196.5Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth CVE-2023-32329.8A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the file CVE-2023-323207.5Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, a CVE-2023-323219.8CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in Ckan CVE-2023-323224.9Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior t CVE-2023-323234.3Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X CVE-2023-323245.5OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote CVE-2023-323256.1PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting.