You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
CVE-2022-36067 - High Severity Vulnerability
Vulnerable Library - vm2-3.9.9.tgz
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Securely!
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/vm2/package.json
Dependency Hierarchy:
Found in HEAD commit: ab82099b14d398d093bec389dcfaee3fd8bb6f07
Found in base branch: master
Vulnerability Details
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.
Publish Date: 2022-09-06
URL: CVE-2022-36067
CVSS 3 Score Details (10.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-mrgp-mrhc-5jrq
Release Date: 2022-09-06
Fix Resolution: vm2 - 3.9.11
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: