@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019080841), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.24.1-20230627140514) +214 more potentially affected by CVE-2023-29199 via vm2 (>=3.0.0, <=3.9.15)

🗓️ 12 Apr 2023 20:42:44Reported by Vulners OSVType

vm2 up to 3.9.15 vulnerable to CVE-2023-29199, enabling sandbox escape and code execution via transitive dependencies.

Reporter	Title	Published	Views	Family All 27
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in CloudPak for Watson AIOPs	31 May 202317:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and Integration Runtime operands that run Designer flows containing a Box node may be vulnerable to arbitrary code execution due to [CVE-2023-29199]	27 Apr 202315:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics is affected but not classified as vulnerable to multiple vulnerabilities	28 Jul 202301:39	–	ibm
BDU FSTEC	The vulnerability of the source code transformer in the vm2 package manager NPM allows a hacker to escape from a isolated programming environment and execute arbitrary code.	19 Apr 202300:00	–	bdu_fstec
Circl	CVE-2023-29199	12 Apr 202320:42	–	circl
CNNVD	vm2 安全漏洞	14 Apr 202300:00	–	cnnvd
CVE	CVE-2023-29199	14 Apr 202318:37	–	cve
Cvelist	CVE-2023-29199 vm2 Sandbox escape vulnerability	14 Apr 202318:37	–	cvelist
Github Security Blog	vm2 Sandbox Escape vulnerability	12 Apr 202320:42	–	github
Tenable Nessus	Node.js Module vm2 < 3.9.16 Sandbox Breakout	14 Sep 202300:00	–	nessus

08 Nov 2023 04:12Current

9High risk

Vulners AI Score9

CVSS 3.19.8 - 10

EPSS0.03852

SSVC