CVE-2023-37466

2023-07-1400:15:09

CWE-94

GitHub_M

web.nvd.nist.gov

vm2

library

security

issue

remote code execution

nvd

cve-2023-37466

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

AI Score

9.9

Confidence

High

EPSS

0.008

Percentile

82.4%

JSON

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.

Affected configurations

Nvd

Vulners

Node

vm2_projectvm2Range≤3.9.19node.js

VendorProductVersionCPE
vm2_projectvm2*cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:node.js:*:*

Vendor	Product	Version	CPE
vm2_project	vm2	*	cpe:2.3:a:vm2_project:vm2::::::node.js::*

CNA Affected

[
  {
    "vendor": "patriksimek",
    "product": "vm2",
    "versions": [
      {
        "version": "<= 3.9.19",
        "status": "affected"
      }
    ]
  }
]