CVE-2022-25893 Vulnerability in npm package vm2

Description

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Remediation

References

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69

https://github.com/patriksimek/vm2/pull/445

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237

https://github.com/patriksimek/vm2/issues/444

Related Vulnerabilities

CVE-2022-1291 Vulnerability in maven package org.webjars.npm:github-com-hhurz-tableexport-jquery-plugin

CVE-2023-38690 Vulnerability in npm package matrix-appservice-irc

CVE-2021-21293 Vulnerability in maven package org.http4s:blaze-core_2.11

CVE-2021-23341 Vulnerability in maven package org.webjars.npm:prismjs

CVE-2021-41174 Vulnerability in npm package @grafana/data

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H