Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-hrqc-8err-4fbx
Vulnerability ID VCID-hrqc-8err-4fbx
Aliases GHSA-22rr-f3p8-5gf8
GMS-2023-2358
Summary Directus affected by VM2 sandbox escape vulnerability ### Impact In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context. ### Patches Patched in v10.6.0 by replacing `vm2` with `isolated-vm` ### Workarounds None ### References https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3.1 7.6 https://github.com/directus/directus
generic_textual HIGH https://github.com/directus/directus
cvssv3.1 7.6 https://github.com/directus/directus/commit/284156426fa94f688e8d65a7a4f34f9e6705f058
generic_textual HIGH https://github.com/directus/directus/commit/284156426fa94f688e8d65a7a4f34f9e6705f058
cvssv3.1 7.6 https://github.com/directus/directus/pull/19332
generic_textual HIGH https://github.com/directus/directus/pull/19332
cvssv3.1 7.6 https://github.com/directus/directus/security/advisories/GHSA-22rr-f3p8-5gf8
generic_textual HIGH https://github.com/directus/directus/security/advisories/GHSA-22rr-f3p8-5gf8
cvssv3.1 7.6 https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
generic_textual HIGH https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
Reference id Reference type URL
https://github.com/directus/directus
https://github.com/directus/directus/commit/284156426fa94f688e8d65a7a4f34f9e6705f058
https://github.com/directus/directus/pull/19332
GHSA-22rr-f3p8-5gf8 https://github.com/advisories/GHSA-22rr-f3p8-5gf8
GHSA-22rr-f3p8-5gf8 https://github.com/directus/directus/security/advisories/GHSA-22rr-f3p8-5gf8
GHSA-cchq-frgv-rjh5 https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/directus/directus
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/directus/directus/commit/284156426fa94f688e8d65a7a4f34f9e6705f058
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/directus/directus/pull/19332
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/directus/directus/security/advisories/GHSA-22rr-f3p8-5gf8
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:C/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none

No EPSS data available for this vulnerability.

Date Actor Action Source VulnerableCode Version
2026-05-30T21:01:55.832602+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/npm/directus/GMS-2023-2358.yml 38.6.0