Patch Released for Critical vm2 Sandbox Escape Vulnerability (CVE-2023-29017, CVE-2023-29199 and CVE-2023-30547)

UPDATE April 19 2023: Updated to include another sandbox vulnerability in vm2 (CVE-2023-30547).Earlier this week, an update was released for a critical sandbox escape vulnerabilities in vm2 (CVE-2023-29017 and CVE-2023-29199) , which ultimately allows for remote code execution by an attacker. vm2 is a widely used module within the Node.js library that provides a sandbox environment. Successfully exploiting both vulnerabilities allows attackers to execute untrusted code on the host system by running and escaping a sandbox on the vulnerable vm2 …

april attackers code code execution critical cve environment escape exploiting host library modules node node.js patch remote code remote code execution sandbox sandbox escape system untrusted update vm2 vulnerabilities vulnerability vulnerable