CVE-2023-29017: Vm2 Sandbox RCE Vulnerability

CVE-2023-29017 Overview

CVE-2023-29017 is a sandbox escape vulnerability in the vm2 JavaScript sandbox library for Node.js. Versions prior to 3.9.15 fail to properly handle host objects passed to Error.prepareStackTrace during unhandled asynchronous errors. An attacker who can submit JavaScript to a vm2 sandbox can break out of the isolation boundary and execute arbitrary commands on the host process. The flaw is classified under [CWE-913: Improper Control of Dynamically-Managed Code Resources]. The maintainers patched the issue in vm2 version 3.9.15. The EPSS score is 74.958% (98.894 percentile), reflecting high observed exploit activity against this widely deployed sandbox.

Critical Impact
Unauthenticated remote code execution on the host running the vm2 sandbox, bypassing all sandbox isolation.

Affected Products

vm2 versions prior to 3.9.15
Node.js applications embedding vm2 for untrusted code execution
Downstream tooling that depends on vm2 (serverless platforms, online code runners, plugin engines)

Discovery Timeline

2023-04-06 - CVE-2023-29017 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-29017

Vulnerability Analysis

The vm2 library implements a sandbox intended to run untrusted JavaScript with a curated set of Node.js built-in modules. Its security model relies on wrapping host objects in proxies so that sandboxed code cannot reach unwrapped references to the outer Node.js context. The vulnerability breaks this guarantee through the V8 engine's Error.prepareStackTrace hook.

When an asynchronous error goes unhandled inside the sandbox, V8 invokes Error.prepareStackTrace to format the stack trace. The vm2 patch shows that the sandbox did not correctly intercept host CallSite objects passed to this hook. Sandboxed code that overrides Error.prepareStackTrace receives raw host objects whose getThis() and related methods return references outside the sandbox. From those references, an attacker can reach the host process object and invoke process.mainModule.require('child_process').execSync() to execute arbitrary commands.

Root Cause

The root cause is incomplete mediation of asynchronous error handling paths. The sandbox proxied synchronous code paths thoroughly but did not sanitize objects passed to user-supplied Error.prepareStackTrace callbacks triggered by async rejections. This is a classic [CWE-913] failure to control dynamically managed code resources at a sandbox boundary.

Attack Vector

The attack requires no authentication and no user interaction. An attacker submits a small JavaScript payload to any service that evaluates untrusted code inside vm2. The payload defines a custom Error.prepareStackTrace handler, then triggers an unhandled asynchronous rejection. When V8 calls the handler, the attacker captures a host CallSite object, walks the prototype chain to reach the host process global, and spawns a child process. A public proof-of-concept is available in a GitHub Gist by seongil-wi, and additional discussion is in the vm2 issue tracker.

Detection Methods for CVE-2023-29017

Indicators of Compromise

Node.js processes embedding vm2 spawning unexpected child processes such as sh, bash, cmd.exe, or powershell.exe.
Outbound network connections initiated by the Node.js host immediately after sandboxed code execution.
Files written outside the application's working directory by the Node.js parent process.
Sandbox runtime errors referencing Error.prepareStackTrace or unhandled promise rejections preceding suspicious activity.

Detection Strategies

Inventory all Node.js applications and verify the installed vm2 version using npm ls vm2; flag any version below 3.9.15.
Use Software Composition Analysis (SCA) tooling to identify transitive dependencies on vulnerable vm2 releases.
Apply EDR behavioral rules that alert when the Node.js runtime invokes child_process.spawn, execSync, or fork outside expected code paths.
Inspect application logs for sandboxed scripts that reference prepareStackTrace, getThis, or constructor.constructor.

Monitoring Recommendations

Forward Node.js process telemetry, including child process creation events, to a centralized analytics platform for correlation.
Monitor file integrity on directories accessible to the Node.js service account, especially configuration and credential stores.
Track egress network connections from servers running vm2-backed services and alert on connections to unfamiliar destinations.

How to Mitigate CVE-2023-29017

Immediate Actions Required

Upgrade vm2 to version 3.9.15 or later across every Node.js project and rebuild affected container images.
Audit all transitive dependencies with npm audit and npm ls vm2, then bump dependency ranges to pull the fixed version.
Restrict the operating system privileges of any service that evaluates untrusted code, running it as a non-root user inside a hardened container or microVM.

Patch Information

The fix landed in vm23.9.15 via commit d534e5785f38307b70d3aac1945260a261a94d50. Details are documented in the GHSA-7jxr-cg7f-gpgv security advisory. Note that the vm2 project has since been deprecated; maintainers recommend migrating to actively maintained alternatives such as isolated-vm.

Workarounds

No application-level workaround exists; the vendor advisory states there are no known workarounds short of upgrading.
Where upgrading is not immediately possible, disable any feature that evaluates untrusted JavaScript and isolate the host using OS-level sandboxing such as seccomp, gVisor, or Firecracker.
Place a network egress policy on the host to block outbound connections from the Node.js process, limiting post-exploitation options.

bash

# Upgrade vm2 to a patched release
npm install vm2@^3.9.15
npm ls vm2