Loading vulnerability…
CVE-2023-30547 is a critical sandbox-escape vulnerability in vm2 versions through 3.9.16. Insufficient exception sanitization permits sandboxed code to raise an unsanitized host exception within vm2's handleException() processing path. The host-context exception can be abused to bypass the vm2 isolation boundary and execute attacker-controlled code in the host Node.js context.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
Small standalone exploit repository for CVE-2023-30547 targeting vm2 versions prior to 3.9.17. The repo contains only a README and one Python script. The README explains the vulnerability, gives a simple version-check snippet, and shows how to run the exploit. The main logic is in exploit.py, which provides an interactive shell-like interface using Python's cmd module. For each entered command, it builds a JavaScript payload that abuses vm2 exception sanitization via a Proxy/getPrototypeOf recursion pattern, escapes the sandbox through constructor access, and executes arbitrary host commands with child_process.execSync. The payload is base64-encoded and sent as JSON in a POST request to a user-supplied URL, implying the intended target is a web application endpoint that accepts code for execution inside vm2. The script then attempts to parse the HTTP response as JSON and print the first returned value, otherwise it prints raw response text. Overall, this is an operational PoC for remote host command execution through a vulnerable vm2-backed code execution service, not merely a detector.
This repository contains a proof-of-concept exploit for CVE-2023-30547, a sandbox escape vulnerability in vm2 (<3.9.17) for Node.js. The exploit is implemented in 'exploit.py', a Python script that provides an interactive shell interface. The user supplies the URL of a target service running a vulnerable vm2 sandbox. The script encodes a malicious JavaScript payload (which exploits the exception sanitization flaw to escape the sandbox and execute arbitrary system commands) in base64 and sends it as a JSON payload to the target via HTTP POST. The exploit expects the target to accept a JSON object with a 'code' field and to execute the provided code in the vm2 sandbox. The README provides background, usage instructions, and references. The repository is structured simply, with a single exploit script and a README. No hardcoded endpoints are present; the user must specify the target URL at runtime.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
12 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Earlier vm2 sandbox escape vulnerability referenced for comparison due to similar mechanics and exploitability trajectory.
A prior vm2 sandbox escape vulnerability via exception sanitization, mentioned as historical context for recurring vm2 escapes.
A prior vm2 sandbox escape vulnerability mentioned only as historical background.
A prior vm2 exception sanitization bypass vulnerability referenced for historical context.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.