CVE-2021-23449

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine...

Code injection

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine...

CVE-2021-23449

The CVE-2021-23449 entry concerns the Node.js vm2 package (pre-3.9.4). A Prototype Pollution flaw allows an attacker to modify Object.prototype via proto /constructor payloads, which can lead to sandbox escape and execution of arbitrary code on the host. Impact is described as remote code executi...

CVE-2021-23449

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine...

CVE-2021-23449

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine...

PT-2021-15533

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.9.4 Description The issue is related to a Prototype Pollution attack vector, which can lead to sandbox escape and execution of arbitrary code on the host machine. This allows for the execution of arbitrary code on the...

CVE-2021-23449: Improperly Controlled Modification of Object Prototype Attributes

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine...

Prototype Pollution

vm2 is vulnerable to prototype pollution. An attacker is able to inject properties into existing construct prototypes and modify attributes via Object.defineProperties...

@accordproject/cicero-cli (>=0.3.4, <=0.23.0-alpha.1), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.0-alpha.1) +143 more potentially affected by CVE-2021-23449 via vm2 (>=3.0.0, <=3.9.3)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2018.7.11-0, =2018.8.5-0, =0.9.14, =2.0.14-alpha.1392172559 and more...

Sandbox Bypass

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Sandbox Bypass via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine. PoC const VM = require"vm2...

Remote Code Execution (RCE)

vm2 is vulnerable to remote code execution RCE. The attack is possible due to the generation of RangeError when a Maximum call stack size is exceeded during the sandboxing of the evaluation of code used within the eval function...

@accordproject/cicero-cli (>=0.3.4, <=0.23.0-alpha.1), @accordproject/cicero-core (>=0.12.5-20190619040852, <=0.23.0-alpha.1) +41 more potentially affected by CVE-2019-10761 via vm2 (>=3.0.0, <=3.6.10)

vm2 NPM version =3.0.0, =0.3.4, =0.12.5-20190619040852, =0.3.12-20180525105709, =0.3.4, =0.11.2-20190326183124, =0.22.2-20210714131804, =0.0.51-20180524154814, =0.0.51-20180524154814, =0.7.4-20190326150718, =2.0.0-rc.8.0.29, =2018.7.11-0, =2018.8.5-0, =4.5.201902251314, =5.0.201901071713,...