Loading vulnerability…
CVE-2023-37903 is a critical sandbox escape vulnerability in vm2, an open-source sandbox for Node.js, affecting versions up to and including 3.9.19. The flaw allows code running inside the vm2 sandbox to abuse the Node.js custom inspect mechanism to escape the sandbox boundary and execute arbitrary code in the host Node.js environment. Exploitation requires that an attacker already be able to execute arbitrary JavaScript within the vm2 sandbox context. The issue breaks vm2’s isolation guarantees and can turn a sandboxed code-execution feature into host-level code execution.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.
This repository provides exploit code for CVE-2023-37903, a vulnerability in the vm2 Node.js library. The repository contains two main JavaScript files: 'PoC.js' and 'Reverse_shell.js'. 'PoC.js' demonstrates arbitrary command execution by running a ping command to an attacker-supplied IP address, serving as a proof of concept. 'Reverse_shell.js' executes a bash command to open a reverse shell to an attacker-controlled IP and port, allowing the attacker to gain remote shell access to the vulnerable system. The README provides a brief description and credits. The exploit requires the attacker to specify their own IP and port, and the target must be running a vulnerable version of vm2. The main attack vector is remote code execution via network interaction, and the payload is a bash reverse shell. No hardcoded endpoints are present; placeholders are used for attacker-supplied values.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A vm2 sandbox bypass issue in Node.js where a prior fix for CVE-2023-37903 could be bypassed by omitting the require option, defeating a security check intended to block the unsafe combination of nesting: true and require: false.
An earlier vm2 vulnerability referenced in the historical discussion and as the basis for a later patch bypass.
A prior vm2 sandbox escape vulnerability whose patch was bypassed by CVE-2026-47137.
An earlier vm2 vulnerability referenced as the incomplete prior fix that CVE-2026-47137 bypasses.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.