Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

vm2 sandbox can let attackers run host code

CVE-2023-30547 · published 11 days ago
Summary

Versions of the vm2 sandbox up to 3.9.16 let a specially crafted error bypass its protections, allowing malicious code to break out of the sandbox and run on the host system. This can lead to unauthorized actions or data exposure. Upgrade to version 3.9.17 or later as soon as possible; no other workaround is available.

What to do
  • Update GitHub Actions vm2 to version 3.9.17.
  • Update vm2 to version 3.9.17-aikido.10.
  • Update rootio @rootio/vm2 to version 3.9.17-root.io.10.
  • Update rootio @rootio/vm2 to version 3.9.17-root.io.7.
  • Update rootio @rootio/vm2 to version 3.9.17-root.io.9.
  • Update GitHub Actions vm2 to version 3.9.17-aikido.7.
  • Update GitHub Actions vm2 to version 3.9.17-aikido.9.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions vm2 < 3.9.17
Fix: upgrade to 3.9.17
– vm2_project vm2 <= 3.9.16
cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*
Root:npm – vm2 < 3.9.17-aikido.10
Fix: upgrade to 3.9.17-aikido.10
Root:npm rootio @rootio/vm2 < 3.9.17-root.io.10
< 3.9.17-root.io.7
< 3.9.17-root.io.9
Fix: upgrade to 3.9.17-root.io.10
Root:npm GitHub Actions vm2 < 3.9.17-aikido.7
< 3.9.17-aikido.9
Fix: upgrade to 3.9.17-aikido.7
Original advisory text
CVE-2023-30547 in vm2 - Patched by Root
Root has patched CVE-2023-30547 in the vm2 package for Root:npm. Multiple fixed versions available.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
73% chance of attack within 30 days
Type
CWE-74Injection
Timeline
Published30 Sep 2026
Updated10 Oct 2026
First seen6 Mar 2026
Sources
GHSA-ch3r-j5x3-6q2m · GHSA
CVE-2023-30547 · NVD
CVE-2023-30547 · OSV
ROOT-APP-NPM-CVE-2023-30547 · OSV
Track software like this
Free during beta