CVE-2023-32313
Inspect method manipulation in vm2
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This vulnerability was patched in the release of version 3.9.18 of vm2. Users are advised to upgrade. Users unable to upgrade may make the inspect method readonly with vm.readonly(inspect) after creating a vm.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Inspect method manipulation in vm2
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This vulnerability was patched in the release of version 3.9.18 of vm2. Users are advised to upgrade. Users unable to upgrade may make the inspect method readonly with vm.readonly(inspect) after creating a vm.
- Record
CVE-2023-32313- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
EUVDEUVD-2023-1591
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This vulnerability was patched in the release of version 3.9.18 of vm2. Users are advised to upgrade. Users unable to upgrade may make the inspect method readonly with vm.readonly(inspect) after creating a vm.
- Record
EUVD-2023-1591- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p5gc-c584-jj6v
vm2 vulnerable to Inspect Manipulation
In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log.
Impact
A threat actor can edit options for console.log.
Patches
This vulnerability was patched in the release of version 3.9.18 of vm2.
Workarounds
After creating a vm make the inspect method readonly with vm.readonly(inspect).
References
PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
For more information
If you have any questions or comments about this advisory:
- Open an issue in VM2
Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
- Record
GHSA-p5gc-c584-jj6v- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
NVD
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This vulnerability was patched in the release of version 3.9.18 of vm2. Users are advised to upgrade. Users unable to upgrade may make the inspect method readonly with vm.readonly(inspect) after creating a vm.
- Record
CVE-2023-32313- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSV
Inspect method manipulation in vm2
vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log. As a result a threat actor can edit options for the console.log command. This vulnerability was patched in the release of version 3.9.18 of vm2. Users are advised to upgrade. Users unable to upgrade may make the inspect method readonly with vm.readonly(inspect) after creating a vm.
- Record
CVE-2023-32313- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVGHSA-p5gc-c584-jj6v
vm2 vulnerable to Inspect Manipulation
In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log.
Impact
A threat actor can edit options for console.log.
Patches
This vulnerability was patched in the release of version 3.9.18 of vm2.
Workarounds
After creating a vm make the inspect method readonly with vm.readonly(inspect).
References
PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
For more information
If you have any questions or comments about this advisory:
- Open an issue in VM2
Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.
- Record
GHSA-p5gc-c584-jj6v- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-74
- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2023-32313 No score
CVE-2023-32313 in vm2 - Patched by Root
Root has patched CVE-2023-32313 in the vm2 package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2023-32313- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
vm2npm |
before 3.9.18 | 3.9.18 |
vm2Root:npm |
before 3.9.17-aikido.11 | 3.9.17-aikido.113.9.17-aikido.123.9.17-aikido.43.9.17-aikido.133.9.17-aikido.53.9.17-aikido.63.9.17-aikido.73.9.17-aikido.83.9.17-aikido.93.9.17-aikido.10 |
@rootio/vm2Root:npm |
before 3.9.17-root.io.2 | 3.9.17-root.io.23.9.17-root.io.33.9.17-root.io.113.9.17-root.io.123.9.17-root.io.43.9.17-root.io.133.9.17-root.io.53.9.17-root.io.63.9.17-root.io.73.9.17-root.io.83.9.17-root.io.93.9.17-root.io.10 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-32313 is a medium vulnerability (CVSS 5.3) in Patriksimek Vm2, published May 15, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.79%, the 56th percentile. Fixed in vm2 3.9.18.
References
github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v
gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
nvd.nist.gov/vuln/detail/CVE-2023-32313