CVE-2023-32313: vm2 vulnerable to Inspect Manipulation
Summary
CVE-2023-32313: vm2 vulnerable to Inspect Manipulation. Affects vm2 versions < 3.9.18. Fixed in 3.9.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is an npm package that provides a sandboxed environment for executing JavaScript code. It allows users to create isolated contexts where they can run untrusted code securely. The package is commonly used in applications that require dynamic code execution or code evaluation. However, versions 3.9.17 and lower of vm2 are vulnerable to Inspect Manipulation.
Vulnerability Detail
In versions 3.9.17 and lower of vm2, it was possible to get a read-write reference to the node inspect method and edit options for console.log. This vulnerability allows a threat actor to modify options for console.log, potentially leading to unauthorized access or manipulation of sensitive information. The impact of this vulnerability can vary depending on the specific usage of console.log within the application.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.9.18
This is the first release that contains the fix.
npm install vm2@3.9.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround is available. After creating a vm using vm2, users can make the inspect method readonly by using the vm.readonly(inspect) function. This prevents any modifications to the options for console.log within the vm context.
Conclusion
In conclusion, the vm2 package versions 3.9.17 and lower are vulnerable to Inspect Manipulation. To mitigate this vulnerability, it is crucial to update the package to version 3.9.18 or higher. Alternatively, users can apply a temporary workaround by making the inspect method readonly. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for vm2 →
FAQ
vm2 is an npm package that provides a sandboxed environment for executing JavaScript code. It allows users to create isolated contexts where they can run untrusted code securely.
The vulnerability allows a threat actor to modify options for console.log, potentially leading to unauthorized access or manipulation of sensitive information. The impact can vary depending on the specific usage of console.log within the application.
To fix this vulnerability, it is recommended to update the vm2 package to version 3.9.18 or higher. Users can update the package by running the command: npm install vm2@latest
Yes, a temporary workaround is available. After creating a vm using vm2, users can make the inspect method readonly by using the vm.readonly(inspect) function. This prevents any modifications to the options for console.log within the vm context.
For more information, you can open an issue in the VM2 GitHub repository: https://github.com/patriksimek/vm2
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
