Multiple Vulnerabilities in vm2 Sandbox Library

The vm2 sandbox library is subject to multiple critical vulnerabilities, tracked as CVE-2023-37480, CVE-2023-37367, and CVE-2023-36657. These vulnerabilities arise from flaws within the sandbox implementation that permit an attacker to escape the restricted environment. By bypassing the sandbox constraints, an unauthenticated attacker can execute arbitrary code on the host system, manipulate sensitive data, perform denial of service attacks, or disclose confidential information. Because vm2 is frequently used to execute untrusted JavaScript code in server-side environments, these vulnerabilities pose a significant risk to applications relying on this library for process isolation. Defenders should verify if their internal applications or third-party dependencies utilize vulnerable versions of vm2 and prioritize upgrading to secure versions or migrating to alternative sandboxing solutions.

Impact

Successful exploitation of these vulnerabilities leads to full sandbox escape, granting the attacker the ability to execute code with the privileges of the Node.js process. This may result in total system compromise, exfiltration of application secrets, and disruption of critical business services through denial of service. The scope of impact is widespread across any server-side application using the affected library versions for code evaluation.

Recommendation

• Identify all applications within the environment utilizing the vm2 library via software composition analysis (SCA) or dependency auditing tools.
• Patch or update affected applications to the latest secure version of vm2 immediately.
• In environments where patching is not immediately feasible, evaluate the implementation of secondary security controls such as containerization or restricted service accounts to limit the blast radius of a potential sandbox escape.
• Review application logs for unusual patterns or child process spawning initiated by the Node.js runtime environment associated with the vm2 library.