CVE-2023-37466

2023-07-1400:15:09

CWE-94

[email protected]

web.nvd.nist.gov

vm2

library

security

issue

remote code execution

nvd

cve-2023-37466

10 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

9.9 High

AI Score

Confidence

High

0.005 Low

EPSS

Percentile

76.0%

JSON

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.

Affected configurations

Vulners

NVD

Node

patriksimekvm2Range≤3.9.19

CPENameOperatorVersion
vm2_project:vm2vm2 project vm2le3.9.19

CPE	Name	Operator	Version
vm2_project:vm2	vm2 project vm2	le	3.9.19

CNA Affected

[
  {
    "vendor": "patriksimek",
    "product": "vm2",
    "versions": [
      {
        "version": "<= 3.9.19",
        "status": "affected"
      }
    ]
  }
]