vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.
CVE-2023-37466 - Critical Severity Vulnerability
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.17.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/vm2/package.json
Dependency Hierarchy: - juicy-chat-bot-0.8.0.tgz (Root Library) - :x: **vm2-3.9.17.tgz** (Vulnerable Library)
Found in base branch: master
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.
Publish Date: 2023-07-14
URL: CVE-2023-37466
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.