CVE-2023-29017: vm2 vulnerable to sandbox escape
Summary
CVE-2023-29017: vm2 vulnerable to sandbox escape. Affects vm2 versions < 3.9.15. Fixed in 3.9.15. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is an npm package that provides a sandboxed environment for executing untrusted JavaScript code. It allows users to run code in a controlled environment to prevent malicious activities. However, a vulnerability has been discovered in versions up to 3.9.14 of vm2, which could allow an attacker to escape the sandbox and execute arbitrary code on the host system. This vulnerability affects Node versions 18.15.0, 19.8.1, and 17.9.1.
Vulnerability Detail
The vulnerability in vm2 arises from improper handling of host objects passed to Error.prepareStackTrace in case of unhandled async errors. This flaw can be exploited by a threat actor to bypass the sandbox protections and gain remote code execution rights on the host running the sandbox. The impact of this vulnerability is critical as it allows an attacker to execute arbitrary code on the host system, potentially leading to further compromise or unauthorized access.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.15
This is the first release that contains the fix.
npm install vm2@3.9.15Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update to the patched version of vm2 to mitigate the risk of sandbox escape.
Conclusion
The vm2 package is vulnerable to a sandbox escape vulnerability that allows an attacker to execute arbitrary code on the host system. It is crucial to update to version 3.9.15 or later of vm2 to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vm2 →
FAQ
vm2 is an npm package that provides a sandboxed environment for executing untrusted JavaScript code. It allows users to run code in a controlled environment to prevent malicious activities.
Versions up to 3.9.14 of vm2 are affected by this vulnerability.
Node versions 18.15.0, 19.8.1, and 17.9.1 are affected by this vulnerability.
The impact of this vulnerability is critical as it allows an attacker to bypass the sandbox protections and execute arbitrary code on the host system.
To fix this vulnerability, update the vm2 package to version 3.9.15 or later by running the command: npm install vm2@3.9.15
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
