Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-mqs7-x7bh-17ef
Vulnerability ID VCID-mqs7-x7bh-17ef
Aliases CVE-2023-30547
GHSA-ch3r-j5x3-6q2m
Summary vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.
Status Published
Exploitability 2.0
Weighted Severity 9.0
Risk 10.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CWE-755 Improper Handling of Exceptional Conditions
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 9.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-30547.json
epss 0.83683 https://api.first.org/data/v1/epss?cve=CVE-2023-30547
epss 0.83683 https://api.first.org/data/v1/epss?cve=CVE-2023-30547
epss 0.83683 https://api.first.org/data/v1/epss?cve=CVE-2023-30547
cvssv3.1 9.8 https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
generic_textual CRITICAL https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
ssvc Track* https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
cvssv3.1_qr CRITICAL https://github.com/advisories/GHSA-ch3r-j5x3-6q2m
cvssv3.1 9.8 https://github.com/patriksimek/vm2
generic_textual CRITICAL https://github.com/patriksimek/vm2
cvssv3.1 9.8 https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
generic_textual CRITICAL https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
ssvc Track* https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
cvssv3.1 9.8 https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
generic_textual CRITICAL https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
ssvc Track* https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
cvssv3.1 9.8 https://github.com/patriksimek/vm2/releases/tag/3.9.17
generic_textual CRITICAL https://github.com/patriksimek/vm2/releases/tag/3.9.17
cvssv3.1 9.8 https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
cvssv3.1_qr CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
generic_textual CRITICAL https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
ssvc Track* https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2023-30547
generic_textual CRITICAL https://nvd.nist.gov/vuln/detail/CVE-2023-30547
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-30547.json
https://api.first.org/data/v1/epss?cve=CVE-2023-30547
https://github.com/patriksimek/vm2
https://github.com/patriksimek/vm2/releases/tag/3.9.17
https://nvd.nist.gov/vuln/detail/CVE-2023-30547
2187608 https://bugzilla.redhat.com/show_bug.cgi?id=2187608
381b230b04936dd4d74aaf90cc8bb244 https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
4b22e87b102d97d45d112a0931dba1aef7eea049 https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
f3db4dee4d76b19869df05ba7880d638a880edd5 https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
GHSA-ch3r-j5x3-6q2m https://github.com/advisories/GHSA-ch3r-j5x3-6q2m
GHSA-ch3r-j5x3-6q2m https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2023-30547.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-02-05T20:29:43Z/ Found at https://gist.github.com/leesh3288/381b230b04936dd4d74aaf90cc8bb244
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-02-05T20:29:43Z/ Found at https://github.com/patriksimek/vm2/commit/4b22e87b102d97d45d112a0931dba1aef7eea049
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-02-05T20:29:43Z/ Found at https://github.com/patriksimek/vm2/commit/f3db4dee4d76b19869df05ba7880d638a880edd5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/releases/tag/3.9.17
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:T/P:M/B:A/M:M/D:R/2025-02-05T20:29:43Z/ Found at https://github.com/patriksimek/vm2/security/advisories/GHSA-ch3r-j5x3-6q2m
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2023-30547
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.99308
EPSS Score 0.83683
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:20:11.647459+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2023/30xxx/CVE-2023-30547.json 38.6.0