CVE-2023-29199 vm2 Sandbox escape vulnerability

🗓️ 14 Apr 2023 18:37:03Reported by GitHub_MType

CVE-2023-29199 vm2 Sandbox escape vulnerability in versions up to 3.9.15. Patched in version 3.9.1

Reporter	Title	Published	Views	Family All 28
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	31 May 202317:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and Integration Runtime operands that run Designer flows containing a Box node may be vulnerable to arbitrary code execution due to [CVE-2023-29199]	27 Apr 202315:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities	28 Jul 202301:39	–	ibm
BDU FSTEC	The vulnerability of the source code transformer in the vm2 package manager NPM allows a hacker to escape from a isolated programming environment and execute arbitrary code.	19 Apr 202300:00	–	bdu_fstec
Circl	CVE-2023-29199	12 Apr 202320:42	–	circl
CNNVD	vm2 安全漏洞	14 Apr 202300:00	–	cnnvd
CVE	CVE-2023-29199	14 Apr 202318:37	–	cve
Github Security Blog	vm2 Sandbox Escape vulnerability	12 Apr 202320:42	–	github
Tenable Nessus	Node.js Module vm2 < 3.9.16 Sandbox Breakout	14 Sep 202300:00	–	nessus
NVD	CVE-2023-29199	14 Apr 202319:15	–	nvd

[
  {
    "vendor": "patriksimek",
    "product": "vm2",
    "versions": [
      {
        "version": "< 3.9.16",
        "status": "affected"
      }
    ]
  }
]

Source	Link
gist	www.gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c
github	www.github.com/patriksimek/vm2/releases/tag/3.9.16
github	www.github.com/patriksimek/vm2/commit/24c724daa7c09f003e556d7cd1c7a8381cb985d7
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985
github	www.github.com/patriksimek/vm2/issues/516

14 Apr 2023 18:37Current

10High risk

Vulners AI Score10

CVSS 3.19.8

EPSS0.24972

CWE-913