https://vulnerability.circl.lu Contains only the most 10 recent sightings. http://www.rssboard.org/rss-specification python-feedgen en Thu, 02 Jul 2026 06:54:58 +0000 https://vulnerability.circl.lu/sighting/ae23b76a-fd65-4a46-a211-66062f197b34/export {"uuid": "ae23b76a-fd65-4a46-a211-66062f197b34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WHPJ-8F3W-67P5", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2667", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-32314\n\ud83d\udd39 Description: vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2023-05-15T19:46:32.834Z\n\ud83d\udccf Modified: 2025-01-22T21:42:31.793Z\n\ud83d\udd17 References:\n1. https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5\n2. https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf\n3. https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac\n4. https://github.com/patriksimek/vm2/releases/tag/3.9.18", "creation_timestamp": "2025-01-22T22:02:32.000000Z"} {"uuid": "ae23b76a-fd65-4a46-a211-66062f197b34", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-WHPJ-8F3W-67P5", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/2667", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2023-32314\n\ud83d\udd39 Description: vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\ud83d\udccf Published: 2023-05-15T19:46:32.834Z\n\ud83d\udccf Modified: 2025-01-22T21:42:31.793Z\n\ud83d\udd17 References:\n1. https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5\n2. https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf\n3. https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac\n4. https://github.com/patriksimek/vm2/releases/tag/3.9.18", "creation_timestamp": "2025-01-22T22:02:32.000000Z"} https://vulnerability.circl.lu/sighting/ae23b76a-fd65-4a46-a211-66062f197b34/export Wed, 22 Jan 2025 22:02:32 +0000