critical9.8
CVE-2022-25893
vm2 vulnerable to Arbitrary Code Execution
Impact
The package vm2 before 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | vm2 | < 3.9.10 | 3.9.10 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Vm2 Project | Vm2 | before 3.9.10 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/patriksimek/vm2/issues/444
- https://github.com/patriksimek/vm2/pull/445
- https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69
- https://security.snyk.io/vuln/SNYK-JS-VM2-2990237
- https://github.com/advisories/GHSA-4w2j-2rg4-5mjw
- https://nvd.nist.gov/vuln/detail/CVE-2022-25893