CVE-2023-30547

Public Exploit
Sandbox Escape in vm2

Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Category

9.8
CVSS
Severity: Critical
CVSS 3.1 •
EPSS 85.68% Top 5%
Vendor Advisory github.com
Affected: patriksimek vm2
Published at:
Updated at:

References

Link Tags
https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m vendor advisory exploit
https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049 patch
https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5 patch
https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244 third party advisory exploit

Frequently Asked Questions

What is the severity of CVE-2023-30547?
CVE-2023-30547 has been scored as a critical severity vulnerability.
How to fix CVE-2023-30547?
To fix CVE-2023-30547, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2023-30547 being actively exploited in the wild?
It is possible that CVE-2023-30547 is being exploited or will be exploited in a near future based on public information. According to its EPSS score, there is a ~86% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2023-30547?
CVE-2023-30547 affects patriksimek vm2.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.