critical9.8
CVE-2021-23449
Prototype Pollution in vm2
Impact
This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | vm2 | < 3.9.4 | 3.9.4 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vm2 Project | Vm2 | before 3.9.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886
- https://github.com/patriksimek/vm2/issues/363
- https://github.com/patriksimek/vm2/releases/tag/3.9.4
- https://security.netapp.com/advisory/ntap-20211029-0010/
- https://snyk.io/vuln/SNYK-JS-VM2-1585918
- https://github.com/advisories/GHSA-rjf2-j2r6-q8gr
- https://nvd.nist.gov/vuln/detail/CVE-2021-23449