CVE-2023-32314: vm2 Sandbox Escape vulnerability
Summary
CVE-2023-32314: vm2 Sandbox Escape vulnerability. Affects vm2 versions < 3.9.18. Fixed in 3.9.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is an npm package that provides a sandbox environment for executing JavaScript code. It is commonly used to run untrusted code securely by isolating it from the host environment. The package allows users to create a sandboxed environment with restricted access to resources and provides an API for executing code within this sandbox. However, versions up to 3.9.17 of vm2 are vulnerable to a sandbox escape vulnerability.
Vulnerability Detail
The vulnerability in vm2 arises from an unexpected creation of a host object based on the specification of Proxy. This allows a threat actor to bypass the sandbox protections and gain remote code execution rights on the host running the sandbox. This can lead to unauthorized access, data breaches, and potential compromise of the entire system.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.18
This is the first release that contains the fix.
npm install vm2@3.9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for this vulnerability. It is essential to update to the patched version of vm2 to ensure the security of the sandbox environment.
Conclusion
The vm2 package is vulnerable to a sandbox escape vulnerability that allows threat actors to bypass the sandbox protections and gain remote code execution rights on the host system. To mitigate this vulnerability, it is crucial to update the vm2 package to version 3.9.18 or later. This will ensure the security of the sandbox environment and prevent unauthorized access and potential system compromise. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vm2 →
FAQ
vm2 is an npm package that provides a sandbox environment for executing JavaScript code. It allows users to run untrusted code securely by isolating it from the host environment.
A sandbox escape vulnerability is a security flaw that allows an attacker to bypass the restrictions imposed by a sandbox environment and gain unauthorized access to the underlying system.
The vulnerability in vm2 allows a threat actor to bypass the sandbox protections and gain remote code execution rights on the host running the sandbox. This can lead to unauthorized access, data breaches, and potential compromise of the entire system.
To fix this vulnerability, it is recommended to update the vm2 package to version 3.9.18 or later. This version includes the necessary patches to mitigate the sandbox escape vulnerability.
There are no known workarounds for this vulnerability. It is essential to update to the patched version of vm2 to ensure the security of the sandbox environment.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
