CVE-2023-29017

🗓️ 06 Apr 2023 19:18:34Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 3 Media mentions👁 226 Views🌐 WEB

vm2 sandbox vulnerability allows remote code executio

Reporter	Title	Published	Views	Family All 34
Huntr	An outdated dependency leads to to remote command execution vulnerability	10 Apr 202316:20	–	huntr
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	27 Apr 202310:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and Integration Runtime operands that run Designer flows containing a Box node may be vulnerable to arbitrary code execution due to [CVE-2023-29017]	27 Apr 202315:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities	28 Jul 202301:39	–	ibm
BDU FSTEC	The vulnerability of the Error.prepareStackTrace object in the vm2 package manager NPM allows a attacker to exit from a isolated programming environment and execute arbitrary code.	11 Apr 202300:00	–	bdu_fstec
Circl	CVE-2023-29017	6 Apr 202319:00	–	circl
CNNVD	vm2 安全漏洞	6 Apr 202300:00	–	cnnvd
Cvelist	CVE-2023-29017 vm2 Sandbox Escape vulnerability	6 Apr 202319:18	–	cvelist
GithubExploit	Exploit for Improper Control of Dynamically-Managed Code Resources in Vm2_Project Vm2	12 Jul 202619:09	–	githubexploit
F5 Networks	K000134725: vm2 vulnerability CVE-2023-29017	22 May 202316:54	–	f5

NVD

Vulners

Node

vm2_project vm2Range<3.9.15node.js

[
  {
    "vendor": "patriksimek",
    "product": "vm2",
    "versions": [
      {
        "version": "< 3.9.15",
        "status": "affected"
      }
    ]
  }
]

Source	Link
gist	www.gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv
github	www.github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50
github	www.github.com/patriksimek/vm2/issues/515

Parameter	Position	Path	Description	CWE
payload	request body	/execute	CVE-2023-29017 PoC delivers malicious JavaScript to vm2 via /execute to trigger unhandled async error path and escape the sandbox.	CWE-913

17 Jun 2026 05:49Current

10High risk

Vulners AI Score10

CVSS 3.19.8 - 10

EPSS0.63186

SSVC

CWE-913