CVE-2022-36067

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of...

@accordproject/cicero-cli (>=0.3.4, <=0.24.1-20231019073743), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.1-20221008145236) +191 more potentially affected by CVE-2022-25893 via vm2 (>=3.0.0, <=3.9.9)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =0.1.1, =1.0.0, =0.1.0, =2.0.0-beta.0 and more Source cves: CVE-2022-258...

@accordproject/cicero-cli (>=0.3.4, <=0.23.0-alpha.1), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.0-alpha.1) +41 more potentially affected by CVE-2019-10761 via vm2 (>=3.0.0, <=3.6.10)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2018.7.11-0, =2018.8.5-0, =4.5.201902251314, =5.0.201901071713,...

vm2 before 3.6.11 vulnerable to sandbox escape

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...

CVE-2019-10761

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...

CVE-2019-10761

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...

Code injection

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...

CVE-2019-10761

CVE-2019-10761 affects vm2 before 3.6.11. A RangeError can be triggered from the host by infinite recursion within the sandbox, allowing the attacker to reference the host’s mainModule and spawn a child_process to execute arbitrary code. Documented exploits/pocs demonstrate sandbox escape and rem...

CVE-2019-10761

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...

PT-2022-8075

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.6.11 Description The issue allows an attacker to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then...

CVE-2019-10761: Uncontrolled Recursion

This affects the package vm2 before 3.6.11. It is possible to trigger a RangeError exception from the host rather than the "sandboxed" context by reaching the stack call limit with an infinite recursion. The returned object is then used to reference the mainModule property of the host code runnin...

vm2 安全漏洞

vm2 is an advanced virtual machine/sandbox for Node.js by individual developer Patrik Simek in the Czech Republic. to run untrusted code using whitelisted Node built-in modules. A security vulnerability exists in vm2 prior to 3.6.11, which stems from reaching the stack call limit via infinite...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to arbitrary code execution due to CVE-2021-23555

Summary Node.js module vm2 is used by IBM App Connect Enterprise Certified Container by the Box connector in a Designer flow. IBM App Connect Enterprise Certified Container IntegrationServers that use the Box connector may be vulnerable to CVE-2021-23555. This bulletin provides patch information ...

CVE-2021-38834

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

CVE-2021-38834

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

Code injection

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

CVE-2021-38834

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

PT-2022-10784

Name of the Vulnerable Software and Affected Versions easy-mock versions 1.5.0 through 1.6.0 Description The issue allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code. Recommendations For easy-mock versions 1.5.0 through 1.6.0, consider...

CVE-2021-38834: Undefined Security Weakness

easy-mock v1.5.0-v1.6.0 allows remote attackers to bypass the vm2 sandbox and execute arbitrary system commands through special js code...

Security Bulletin: A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js vm2 module affects IBM Cloud Automation Manager. Vulnerability Details CVEID:CVE-2021-23555 DESCRIPTION: Node.js vm2 module could allow a remote attacker to execute arbitrary code on the system, caused by a sandbox bypass flaw during generation of a...