CVE-2023-32314

CriticalCVSS 10.0/10Last modified Jun 17, 2026

Description

vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 10.0/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

No affected versions have been published.

Timeline

Published
May 15, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-323157.5Openfire is an XMPP server licensed under the Open Source Apache License. Openfire's administrative console, a web-based application, was foCVE-2023-323164.3CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorCVE-2023-323177.2Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the MOSS cheaCVE-2023-323186.7Nextcloud server provides a home for data. A regression in the session handling between Nextcloud Server and the Nextcloud Text app preventeCVE-2023-323196.5Nextcloud server is an open source personal cloud implementation. Missing brute-force protection on the WebDAV endpoints via the basic auth CVE-2023-32329.8A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 and classified as critical. This issue affects some unknown processing of the fileCVE-2023-323207.5Nextcloud Server is a data storage system for Nextcloud, a self-hosted productivity platform. When multiple requests are sent in parallel, aCVE-2023-323219.8CKAN is an open-source data management system for powering data hubs and data portals. Multiple vulnerabilities have been discovered in CkanCVE-2023-323224.9Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior tCVE-2023-323234.3Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. A malicious user on a Synapse homeserver X CVE-2023-323245.5OpenPrinting CUPS is an open source printing system. In versions 2.4.2 and prior, a heap buffer overflow vulnerability would allow a remote CVE-2023-323256.1PostHog-js is a library to interface with the PostHog analytics tool. Versions prior to 1.57.2 have the potential for cross-site scripting.