CVE-2023-30547

CRITICAL

Vm2 < 3.9.16 - Injection

Title source: rule
STIX 2.1

Exploitation Summary

EIP tracks 5 public exploits for CVE-2023-30547. PoCs published by rvizx, rvzsec, Cur1iosity.

AI-analyzed exploit summary This repository contains a functional PoC exploit for CVE-2023-30547, a VM2 sandbox escape vulnerability. The exploit leverages exception sanitization flaws to achieve arbitrary code execution in the host context.

Description

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside `handleException()` which can be used to escape the sandbox and run arbitrary code in host context. This vulnerability was patched in the release of version `3.9.17` of `vm2`. There are no known workarounds for this vulnerability. Users are advised to upgrade.

Exploits (5)

nomisec WORKING POC 47 stars
by rvizx · poc
https://github.com/rvizx/CVE-2023-30547

This repository contains a functional PoC exploit for CVE-2023-30547, a VM2 sandbox escape vulnerability. The exploit leverages exception sanitization flaws to achieve arbitrary code execution in the host context.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vm2 < 3.9.17
No auth needed
Prerequisites: Target must be running a vulnerable version of vm2 (< 3.9.17) · Ability to send crafted payloads to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 46 stars
by rvzsec · poc
https://github.com/rvzsec/CVE-2023-30547

This repository contains a functional exploit for CVE-2023-30547, a VM2 sandbox escape vulnerability. The exploit leverages a flaw in exception sanitization to achieve arbitrary code execution by manipulating the prototype chain and throwing a proxied error.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vm2 < 3.9.17
No auth needed
Prerequisites: Target must be running a vulnerable version of vm2 (< 3.9.17) · Ability to send crafted payloads to the target
devstral-2 · analyzed Jun 01, 2026 Full analysis →
nomisec WORKING POC 1 stars
by Cur1iosity · poc
https://github.com/Cur1iosity/CVE-2023-30547

This repository contains a Python-based exploit for CVE-2023-30547, a sandbox escape vulnerability in vm2 versions up to 3.9.16. The exploit leverages exception sanitization flaws to execute arbitrary commands, spawn reverse shells, or establish web shells on vulnerable targets.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vm2 (versions < 3.9.17)
No auth needed
Prerequisites: Target must be running a vulnerable version of vm2 (< 3.9.17) · Network access to the target's endpoint
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by junnythemarksman · poc
https://github.com/junnythemarksman/CVE-2023-30547

This PoC exploits CVE-2023-30547 in vm2 sandbox by leveraging unsanitized host exceptions to escape the sandbox and execute arbitrary code. It sends a base64-encoded payload via HTTP POST to a vulnerable endpoint, triggering a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vm2 (versions up to 3.9.16)
No auth needed
Prerequisites: Vulnerable vm2 version (≤3.9.16) · Network access to target endpoint · Listener setup for reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC
by user0x1337 · poc
https://github.com/user0x1337/CVE-2023-30547

This is a functional Proof-of-Concept exploit for CVE-2023-30547, a vm2 sandbox escape vulnerability. It leverages a prototype pollution technique to achieve remote code execution (RCE) via a reverse shell.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: vm2 (versions prior to 3.9.16)
No auth needed
Prerequisites: Target must be running a vulnerable version of vm2 · Network access to the target URL · Listener set up for reverse shell
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 9.8
EPSS 0.8368
EPSS Percentile 99.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-74
Status published
Products (2)
npm/vm2 0 - 3.9.17npm
vm2_project/vm2 < 3.9.16
Published Apr 17, 2023
Tracked Since Feb 18, 2026