GitHub Advisoryadvisory · npm

GHSA-rjf2-j2r6-q8gr Prototype Pollution in vm2

CRITICAL Published 2021-10-19 Modified 2021-10-19 Official page ↗
Aliases
CVE-2021-23449
Ecosystem
npm
Packages
vm2
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-1321, CWE-915
Reviewed
2021-10-19

Affected packages

• npm vm2: < 3.9.4 → fixed in 3.9.4

Description

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.

Related

Alias · CVE (1)

  • CVE-2021-23449 This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the… vulnerability

Weakness · CWE (2)

  • CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
  • CWE-915 Improperly Controlled Modification of Dynamically-Determined Object Attributes weakness

References