vm2 Sandbox Escape vulnerability

CVE-2023-37466

What is CVE-2023-37466?

The vm2 library, a popular sandbox for Node.js, has a significant vulnerability that allows unauthorized access to a system's environment. This issue arises from a flaw in the sanitization of Promise handlers, which can be bypassed using the @@species accessor property. As a result, attackers can escape the sandbox environment and execute arbitrary code, potentially leading to severe security breaches. Users are strongly advised to avoid using vm2 in production due to the discontinued maintenance and this critical vulnerability.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References