https://vulnerability.circl.lu/sightings/feed 2026-07-02T06:54:54.353789+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/ae23b76a-fd65-4a46-a211-66062f197b34/export 2026-07-02T06:54:54.361713+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "ae23b76a-fd65-4a46-a211-66062f197b34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WHPJ-8F3W-67P5", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2667", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-32314\n\ud83d\udd39 Description: vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2023-05-15T19:46:32.834Z\n\ud83d\udccf Modified: 2025-01-22T21:42:31.793Z\n\ud83d\udd17 References:\n1. https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5\n2. https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf\n3. https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac\n4. https://github.com/patriksimek/vm2/releases/tag/3.9.18", "creation_timestamp": "2025-01-22T22:02:32.000000Z"} 2025-01-22T22:02:32+00:00