CVE-2023-37466
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk81th percentile - higher than 81% of all known CVEs
Summary
The vm2 library, an advanced sandbox for Node.js, contains critical security issues and should not be used in production. In versions up to 3.9.19, `Promise` handler sanitization can be bypassed, allowing attackers to escape the sandbox and execute arbitrary code.
Risk Assessment
Allowing attackers to execute arbitrary code within the context of the vm2 sandbox poses a serious threat to the security of the organization's applications and data.
Recommendation
It is recommended to upgrade to version 3.10.0 or later, which includes a patch for this security issue.
Original NVD description (English source)
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.