vm2 Sandbox Escape vulnerability

CVE-2023-37466

What is CVE-2023-37466?

The vm2 library, a popular sandbox for Node.js, has a significant vulnerability that allows unauthorized access to a system's environment. This issue arises from a flaw in the sanitization of Promise handlers, which can be bypassed using the @@species accessor property. As a result, attackers can escape the sandbox environment and execute arbitrary code, potentially leading to severe security breaches. Users are strongly advised to avoid using vm2 in production due to the discontinued maintenance and this critical vulnerability.

References