CVE-2023-32313

vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.

• CWE-74

• https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550Product
• https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238Patch
• https://github.com/patriksimek/vm2/releases/tag/3.9.18Release Notes
• https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6vVendor Advisory
• https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550Product
• https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238Patch
• https://github.com/patriksimek/vm2/releases/tag/3.9.18Release Notes
• https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6vVendor Advisory

Published

May 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32308anuko timetracker is an open source time tracking system. Bo…9.8
• CVE-2023-32309PyMdown Extensions is a set of extensions for the `Python-Ma…7.5
• CVE-2023-3231A vulnerability has been found in UJCMS up to 6.0.2 and clas…6.5
• CVE-2023-32310DataEase is an open source data visualization and analysis t…8.1
• CVE-2023-32311CloudExplorer Lite is an open source cloud management platfo…4.3
• CVE-2023-32312UmbracoIdentityExtensions is an Umbraco add-on package that …5.3
• CVE-2023-32314vm2 is a sandbox that can run untrusted code with Node's bui…10
• CVE-2023-32315Openfire is an XMPP server licensed under the Open Source Ap…7.5
• CVE-2023-32316CloudExplorer Lite is an open source cloud management tool. …4.3
• CVE-2023-32317Autolab is a course management service that enables auto-gra…7.2
• CVE-2023-32318Nextcloud server provides a home for data. A regression in t…6.7
• CVE-2023-32319Nextcloud server is an open source personal cloud implementa…6.5