CVE-2023-32313
Medium
Description
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.
SeverityMedium
CVSS5.3
Exploit probability—
ProductVm2
PublishedMay 15, 2023
First seenMay 15, 2023
Weakness typeCWE-74Injection
How to fix
Update
- vm2_project vm23.9.18 or later
- vm23.9.18 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| vm2_project vm2 | v < 3.9.18 | 3.9.18 |
| vm2npm | v < 3.9.18 | 3.9.18 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.