CVE-2023-29199

2023-04-1419:15:09

CWE-913

GitHub_M

web.nvd.nist.gov

382

nvd

cve-2023-29199

vm2

source code transformer

vulnerability

sandbox bypass

remote code execution

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.7

Confidence

High

EPSS

0.017

Percentile

88.1%

JSON

There exists a vulnerability in source code transformer (exception sanitization logic) of vm2 for versions up to 3.9.15, allowing attackers to bypass handleException() and leak unsanitized host exceptions which can be used to escape the sandbox and run arbitrary code in host context. A threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.16 of vm2.

Affected configurations

Nvd

Vulners

Node

vm2_projectvm2Range<3.9.16node.js

CNA Affected

[
  {
    "vendor": "patriksimek",
    "product": "vm2",
    "versions": [
      {
        "version": "< 3.9.16",
        "status": "affected"
      }
    ]
  }
]