CVE-2023-32314

vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-74

• https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5acExploit, Third Party Advisory
• https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912dafPatch
• https://github.com/patriksimek/vm2/releases/tag/3.9.18Release Notes
• https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5Vendor Advisory
• https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5acExploit, Third Party Advisory
• https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912dafPatch
• https://github.com/patriksimek/vm2/releases/tag/3.9.18Release Notes
• https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5Vendor Advisory

Published

May 15, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32309PyMdown Extensions is a set of extensions for the `Python-Ma…7.5
• CVE-2023-3231A vulnerability has been found in UJCMS up to 6.0.2 and clas…6.5
• CVE-2023-32310DataEase is an open source data visualization and analysis t…8.1
• CVE-2023-32311CloudExplorer Lite is an open source cloud management platfo…4.3
• CVE-2023-32312UmbracoIdentityExtensions is an Umbraco add-on package that …5.3
• CVE-2023-32313vm2 is a sandbox that can run untrusted code with Node's bui…5.3
• CVE-2023-32315Openfire is an XMPP server licensed under the Open Source Ap…7.5
• CVE-2023-32316CloudExplorer Lite is an open source cloud management tool. …4.3
• CVE-2023-32317Autolab is a course management service that enables auto-gra…7.2
• CVE-2023-32318Nextcloud server provides a home for data. A regression in t…6.7
• CVE-2023-32319Nextcloud server is an open source personal cloud implementa…6.5
• CVE-2023-3232A vulnerability was found in Zhong Bang CRMEB up to 4.6.0 an…9.8