vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.
History

Sun, 08 Sep 2024 19:00:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.1::el8

Mon, 19 Aug 2024 22:30:00 +0000

Type Values Removed Values Added
CPEs cpe:/a:redhat:acm:2.6::el8
cpe:/a:redhat:multicluster_engine:2.1::el8

cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2023-07-21T19:42:09.346Z

Updated: 2024-08-02T17:23:27.770Z

Reserved: 2023-07-10T17:51:29.610Z

Link: CVE-2023-37903

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-07-21T20:15:16.057

Modified: 2024-11-21T08:12:26.023

Link: CVE-2023-37903

cve-icon Redhat

Severity : Moderate

Publid Date: 2023-07-21T00:00:00Z

Links: CVE-2023-37903 - Bugzilla