CVE-2023-30547: vm2 Sandbox Escape vulnerability
Summary
CVE-2023-30547: vm2 Sandbox Escape vulnerability. Affects vm2 versions < 3.9.17. Fixed in 3.9.17. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vm2 package is an npm package that provides a sandboxed environment for executing JavaScript code. It allows users to run untrusted code in a controlled environment, preventing any malicious actions from affecting the host system. However, versions up to 3.9.16 of vm2 contain a vulnerability in exception sanitization. This vulnerability allows attackers to raise an unsanitized host exception inside handleException(), enabling them to escape the sandbox and execute arbitrary code in the host context.
Vulnerability Detail
The vulnerability in vm2 allows threat actors to bypass the sandbox protections and gain remote code execution rights on the host system. By exploiting the exception sanitization flaw, an attacker can execute arbitrary code outside the sandboxed environment, potentially leading to unauthorized access, data breaches, or further compromise of the host system. The vulnerability has a CVSS score of 9.8, indicating its critical severity.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.17
This is the first release that contains the fix.
npm install vm2@3.9.17Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update to the patched version of vm2 to address the issue effectively.
Conclusion
The vm2 package up to version 3.9.16 is vulnerable to a sandbox escape vulnerability that allows attackers to execute arbitrary code in the host context. To mitigate this issue, it is crucial to update to version 3.9.17 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability allows threat actors to escape the sandbox and execute arbitrary code in the host context. This can lead to remote code execution on the host system, potentially resulting in unauthorized access, data breaches, or further compromise.
Versions up to 3.9.16 of vm2 are affected by this vulnerability.
Yes, this vulnerability has been patched in version 3.9.17 of vm2.
No, there are no known workarounds for this vulnerability. Updating to the patched version is the recommended solution.
This vulnerability was disclosed by Xion (SeungHyun Lee) of KAIST Hacking Lab.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
