CVE-2023-37903

CVSS 3.1: 10.0 critical
EPSS: 4%p90
Published: Jul 21, 2023 · Jul 21, 2023
Modified: Jun 17, 2026

Analyze CVE-2023-37903 with Vani AIImpact, affected versions, exploitation status, mitigations and detection

Description · NVD

vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.

Vendors: vm2 project

Products: vm2

Weakness: CWE-78

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (4.2%)

In the news

1 story

Critical vm2 Node.js Flaw Allows Sandbox Escape and Arbitrary Code Execution

The Hacker NewsJan 29, 06:05 UTC · Jan 29, 2026VulnerabilityCVE-2026-22709 CVE-2022-36067 CVE-2023-29017+54 · 2 reads