Vm2 (<= 3.9.16) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/vm2--3.9.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 04 Sep 2026 18:06:45 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMultiple Arbitrary Code Execution Vulnerabilities in vm2https://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/Fri, 04 Sep 2026 18:06:45 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-vm2-sandbox-escape/Multiple vulnerabilities in the vm2 JavaScript sandbox library, including CVE-2023-30547, CVE-2023-32314, and CVE-2023-32675, allow attackers to escape the sandbox and execute arbitrary code on the host system.The JavaScript library vm2, widely used for running untrusted code in a sandboxed environment, contains multiple critical vulnerabilities that permit attackers to break out of the sandbox. These vulnerabilities, tracked under CVE-2023-30547, CVE-2023-32314, and CVE-2023-32675, stem from improper sanitization of error objects and mishandling of asynchronous operations. By exploiting these flaws, an attacker can bypass the security boundaries intended to isolate the guest code, leading to arbitrary code execution on the underlying host operating system. Given the library's role in security-sensitive isolation tasks, this risk is severe for any application or platform that processes user-supplied JavaScript using vulnerable versions of the vm2 sandbox. Defenders should prioritize auditing dependencies and migrating to alternative isolation mechanisms, as vm2 has been deprecated due to persistent sandbox escape issues.

Impact

Successful exploitation allows a guest user to elevate privileges from the sandbox to the host environment. This can lead to full system compromise, data exfiltration, or lateral movement within the network. These flaws impact a wide range of Node.js applications that utilize vm2 for security-critical sandboxing of user-provided content.

Recommendation

Identify all applications within the environment that utilize the vm2 library via software composition analysis tools. Since the library is deprecated and no longer receives security updates, migration to a more secure isolation alternative such as Web Workers or dedicated virtual machines is required. Review all instances of code executing user-supplied JavaScript to ensure the sandbox is removed or replaced.

]]>criticaladvisoryvulnerabilitysandbox-escapecode-execution