Multiple Arbitrary Code Execution Vulnerabilities in vm2

The JavaScript library vm2, widely used for running untrusted code in a sandboxed environment, contains multiple critical vulnerabilities that permit attackers to break out of the sandbox. These vulnerabilities, tracked under CVE-2023-30547, CVE-2023-32314, and CVE-2023-32675, stem from improper sanitization of error objects and mishandling of asynchronous operations. By exploiting these flaws, an attacker can bypass the security boundaries intended to isolate the guest code, leading to arbitrary code execution on the underlying host operating system. Given the library's role in security-sensitive isolation tasks, this risk is severe for any application or platform that processes user-supplied JavaScript using vulnerable versions of the vm2 sandbox. Defenders should prioritize auditing dependencies and migrating to alternative isolation mechanisms, as vm2 has been deprecated due to persistent sandbox escape issues.

Impact

Successful exploitation allows a guest user to elevate privileges from the sandbox to the host environment. This can lead to full system compromise, data exfiltration, or lateral movement within the network. These flaws impact a wide range of Node.js applications that utilize vm2 for security-critical sandboxing of user-provided content.

Recommendation

Identify all applications within the environment that utilize the vm2 library via software composition analysis tools. Since the library is deprecated and no longer receives security updates, migration to a more secure isolation alternative such as Web Workers or dedicated virtual machines is required. Review all instances of code executing user-supplied JavaScript to ensure the sandbox is removed or replaced.