Soketi was exposed to Sandbox Escape vulnerability via vm2
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
### Impact _What kind of vulnerability is it? Who is impacted?_ Anyone who might have used Soketi with the `cluster` driver (or through PM2). ### Patches _Has the problem been patched? What versions should users upgrade to?_ Get the latest version of Soketi. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ None. It's advised to upgrade to the latest version. ### References _Are there any links users can visit to find out more?_ - https://github.com/advisories/GHSA-cchq-frgv-rjh5 - https://github.com/patriksimek/vm2/issues/533 - https://github.com/Unitech/pm2/issues/5643
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | @soketi/soketi (npm) | before 1.6.0 | 1.6.0 | Patch available | GHSA-g6w6-h933-4rc5 |
- @soketi/soketi (npm) Vendor— Affected before 1.6.0 Fixed in 1.6.0 Patch available GHSA-g6w6-h933-4rc5
Remediation
- Fix · GHSA-g6w6-h933-4rc5 @soketi/soketi (npm) Fixed in 1.6.0 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-g6w6-h933-4rc5
References
Other 7
- https://github.com/soketi/soketi/security/advisories/GHSA-g6w6-h933-4rc5
- https://github.com/Unitech/pm2/issues/5643
- https://github.com/patriksimek/vm2/issues/533
- https://github.com/soketi/soketi/pull/927
- https://github.com/soketi/soketi/commit/de12bff706c0d62e6a57dc1c7be3c4f014d0093a
- https://github.com/soketi/soketi
- https://github.com/soketi/soketi/releases/tag/1.6.0
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences