CVEvulnerability
CVE-2022-25893
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2022-12-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1 ([email protected])
- 9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-471
Description
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Affected configurations
• vm2 project vm2 (< 3.9.10)
Related
Weakness · CWE (1)
- CWE-471 Modification of Assumed-Immutable Data (MAID) weakness
References
- https://github.com/patriksimek/vm2/issues/444 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/patriksimek/vm2/pull/445 Patch, Third Party Advisory
- https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69 Patch, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-VM2-2990237 Exploit, Patch, Third Party Advisory
- https://github.com/patriksimek/vm2/issues/444 Exploit, Issue Tracking, Third Party Advisory
- https://github.com/patriksimek/vm2/pull/445 Patch, Third Party Advisory
- https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69 Patch, Third Party Advisory
- https://security.snyk.io/vuln/SNYK-JS-VM2-2990237 Exploit, Patch, Third Party Advisory