CVE-2022-25893

CRITICAL

9.8

Descripcion

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Detalles CVE

Puntuacion CVSS v3.19.8

SeveridadCRITICAL

Vector CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vector de ataqueNETWORK

ComplejidadLOW

Privilegios requeridosNONE

Interaccion usuarioNONE

Publicado12/21/2022

Ultima modificacion4/15/2025

Fuentenvd

Avistamientos honeypot0

Productos afectados

vm2_project:vm2

Debilidades (CWE)

CWE-471

Referencias

https://github.com/patriksimek/vm2/issues/444(report@snyk.io)

https://github.com/patriksimek/vm2/pull/445(report@snyk.io)

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69(report@snyk.io)

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237(report@snyk.io)

https://github.com/patriksimek/vm2/issues/444(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/patriksimek/vm2/pull/445(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69(af854a3a-2127-422b-91ae-364da2661108)

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237(af854a3a-2127-422b-91ae-364da2661108)

Correlaciones IOC

Sin correlaciones registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.