CVE-2023-30547

CVSS 3.1: 10.0 critical
EPSS: 73%p99
Published: Apr 17, 2023 · Apr 17, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-30547 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Vendors: vm2 project

Products: vm2

Weakness: CWE-74

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (73.0%)

In the news

2 stories

Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution

The Hacker NewsJan 29, 06:05 UTC · Jan 29, 2026VulnerabilityCVE-2026-22709 CVE-2022-36067 CVE-2023-29017+54 · 2 reads

Critical Flaws in vm2 JavaScript Library Can Lead to Remote Code Execution

The Hacker NewsApr 20, 04:45 UTC · Apr 20, 2023VulnerabilityCVE-2023-29199 CVE-2023-30547 CVE-2023-29017+15