{"id":"GHSA-g6w6-h933-4rc5","aliases":[],"status":"published","title":"Soketi was exposed to Sandbox Escape vulnerability via vm2","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAnyone who might have used Soketi with the `cluster` driver (or through PM2).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nGet the latest version of Soketi.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nNone. It's advised to upgrade to the latest version.\n\n### References\n_Are there any links users can visit to find out more?_\n- https://github.com/advisories/GHSA-cchq-frgv-rjh5\n- https://github.com/patriksimek/vm2/issues/533\n- https://github.com/Unitech/pm2/issues/5643","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-08-03T19:44:52Z","modified":"2023-08-03T19:44:53Z","fixes":[{"ecosystem":"npm","package":"@soketi/soketi","fixed_in":["1.6.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"@soketi/soketi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]},{"source":"osv","ecosystem":"npm","package":"@soketi/soketi","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.6.0"}]}]}],"references":[{"url":"https://github.com/soketi/soketi/security/advisories/GHSA-g6w6-h933-4rc5","tags":["web"]},{"url":"https://github.com/Unitech/pm2/issues/5643","tags":["web"]},{"url":"https://github.com/patriksimek/vm2/issues/533","tags":["web"]},{"url":"https://github.com/soketi/soketi/pull/927","tags":["web"]},{"url":"https://github.com/soketi/soketi/commit/de12bff706c0d62e6a57dc1c7be3c4f014d0093a","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cchq-frgv-rjh5","tags":["advisory"]},{"url":"https://github.com/soketi/soketi/releases/tag/1.6.0","tags":["web"]},{"url":"https://github.com/advisories/GHSA-g6w6-h933-4rc5"},{"url":"https://github.com/soketi/soketi","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-g6w6-h933-4rc5","title":"Soketi was exposed to Sandbox Escape vulnerability via vm2","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAnyone who might have used Soketi with the `cluster` driver (or through PM2).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nGet the latest version of Soketi.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nNone. It's advised to upgrade to the latest version.\n\n### References\n_Are there any links users can visit to find out more?_\n- https://github.com/advisories/GHSA-cchq-frgv-rjh5\n- https://github.com/patriksimek/vm2/issues/533\n- https://github.com/Unitech/pm2/issues/5643\n","status":"published","published":"2023-08-03T19:44:52Z","modified":"2023-08-03T19:44:53Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T14:36:59.456342Z"}],"osv":[{"id":"GHSA-g6w6-h933-4rc5","title":"Soketi was exposed to Sandbox Escape vulnerability via vm2","description":"### Impact\n_What kind of vulnerability is it? Who is impacted?_\nAnyone who might have used Soketi with the `cluster` driver (or through PM2).\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\nGet the latest version of Soketi.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\nNone. It's advised to upgrade to the latest version.\n\n### References\n_Are there any links users can visit to find out more?_\n- https://github.com/advisories/GHSA-cchq-frgv-rjh5\n- https://github.com/patriksimek/vm2/issues/533\n- https://github.com/Unitech/pm2/issues/5643\n","status":"published","published":"2023-08-03T19:44:52Z","modified":"2023-08-03T19:44:52Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:46:47.472172Z"}]}}