Test ID:	1.3.6.1.4.1.25623.1.0.170513
Category:	General
Title:	vm2 <= 3.9.19 Multiple Sandbox Escape Vulnerabilities (Jul 2023)
Summary:	vm2 is prone to multiple sandbox escape vulnerabilities.
Description:	Summary: vm2 is prone to multiple sandbox escape vulnerabilities. Vulnerability Insight: The following vulnerabilities exist: - CVE-2023-37466: Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. - CVE-2023-37903: Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. Vulnerability Impact: Exploiting these vulnerabilities leads to remote code execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. Affected Software/OS: vm2 version 3.9.19 and prior. Solution: No solution was made available by the vendor. Vendor statement: The library contains critical security issues and should not be used for production! The maintenance of the project has been discontinued. Consider migrating your code to isolated-vm. CVSS Score: 10.0 CVSS Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2023-37466 https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 Common Vulnerability Exposure (CVE) ID: CVE-2023-37903 https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
Copyright	Copyright (C) 2023 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.