PT-2023-3541 · Node.Js · Vm2

Seunghyun Lee + 1 · Published 2023-07-06 · Updated 2026-05-25 · CVE-2023-37466

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.10.0

Description vm2 is an advanced sandbox for Node.js. A flaw in the sanitization of the Promise handler allows the @@species accessor property to be bypassed. This enables attackers who already have arbitrary code execution primitives within the sandbox context to escape the isolated environment and execute arbitrary code on the host system, potentially leading to remote code execution. The project maintenance has been discontinued, and the library is not recommended for production use.

Recommendations Update to version 3.10.0.

Exploit

Fix

RCE

Code Injection

Weakness Enumeration

CWE-265

CWE-94

Related Identifiers

BDU:2023-03752

CVE-2023-37466

GHSA-CCHQ-FRGV-RJH5

Affected Products

Vm2

References · 29

• 🔥 https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/37xxx/CVE-2023-37466.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-37466 · Security Note
• https://osv.dev/vulnerability/GHSA-cchq-frgv-rjh5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-37466 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2023-37466 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-03752 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.10.0 · Note
• https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744 · Note
• https://twitter.com/0dayPublishing/status/2008292646452601004 · Twitter Post
• https://t.me/cveNotify/162777 · Telegram Post
• https://t.me/cveNotify/147775 · Telegram Post
• https://t.me/cvenotify/69539 · Telegram Post
• https://twitter.com/CVEnew/status/2051361294456901951 · Twitter Post