CVE-2022-25893

CRITICAL

9.8

Description

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

CVE Details

CVSS v3.1 Score9.8

SeverityCRITICAL

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/21/2022

Last Modified4/15/2025

Sourcenvd

Honeypot Sightings0

Affected Products

vm2_project:vm2

Weaknesses (CWE)

CWE-471

References

https://github.com/patriksimek/vm2/issues/444(report@snyk.io)

https://github.com/patriksimek/vm2/pull/445(report@snyk.io)

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69(report@snyk.io)

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237(report@snyk.io)

https://github.com/patriksimek/vm2/issues/444(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/patriksimek/vm2/pull/445(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69(af854a3a-2127-422b-91ae-364da2661108)

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.