VDB
BDU%3A2023-01956
BDU%3A2023-01956
PUBLISHED
CVSS 10 CRITICAL
Уязвимость объекта Error.prepareStackTrace библиотеки vm2 пакетного менеджера NPM, позволяющая нарушителю выйти из изолированной программной среды и выполнить произвольный код
Risk Scores
CVSS 3.1
10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| patriksimek | vm2 | * |
| Red Hat Inc., Node.js Foundation | Red Hat Advanced Cluster Management for Kubernetes, vm2 |
Timeline
- Apr 6, 2023 CVE Published
- Apr 7, 2023 PoC Published
- Apr 8, 2023 PoC Published
- Apr 8, 2023 PoC Published
- Apr 8, 2023 PoC Published
- Apr 10, 2023 PoC Published
- Apr 10, 2023 PoC Published
- Apr 12, 2023 CVE Updated
- Apr 14, 2023 PoC Published
- Apr 18, 2023 PoC Published
- Dec 29, 2023 PoC Published
- Aug 31, 2025 PoC Published
References
- https://access.redhat.com/security/cve/cve-2023-29017 url
- https://github.com/patriksimek/vm2/security/advisories/GHSA-7jxr-cg7f-gpgv url
- https://github.com/patriksimek/vm2/issues/515 url
- https://github.com/patriksimek/vm2/commit/d534e5785f38307b70d3aac1945260a261a94d50 url
- https://gist.github.com/seongil-wi/2a44e082001b959bfe304b62121fb76d url