CVE-2022-25893

CRITICAL

9.8

Description

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Details CVE

Score CVSS v3.19.8

SeveriteCRITICAL

Vecteur CVSSCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Vecteur d'attaqueNETWORK

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurNONE

Publie12/21/2022

Derniere modification4/15/2025

Sourcenvd

Observations honeypot0

Produits affectes

vm2_project:vm2

Faiblesses (CWE)

CWE-471

References

https://github.com/patriksimek/vm2/issues/444(report@snyk.io)

https://github.com/patriksimek/vm2/pull/445(report@snyk.io)

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69(report@snyk.io)

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237(report@snyk.io)

https://github.com/patriksimek/vm2/issues/444(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/patriksimek/vm2/pull/445(af854a3a-2127-422b-91ae-364da2661108)

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69(af854a3a-2127-422b-91ae-364da2661108)

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237(af854a3a-2127-422b-91ae-364da2661108)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.