~ / search / GHSA-4w2j-2rg4-5mjw

GHSA-4w2j-2rg4-5mjw

vm2 vulnerable to Arbitrary Code Execution

Source: GitHub Advisory Database (reviewed) Critical CVE-2022-25893

Packages

EcosystemPackageAffectedFixed in
npm vm2 < 3.9.10 3.9.10

Details

As written in the advisory (Markdown source, shown as plain text).

The package vm2 before 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

References

External links from the advisory. They lead to third-party sites.