Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS02cHcyLTVoanYtOXBmN80rFg
Sandbox bypass in vm2
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
Permalink: https://github.com/advisories/GHSA-6pw2-5hjv-9pf7JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS02cHcyLTVoanYtOXBmN80rFg
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Critical
Classification: General
Published: about 2 years ago
Updated: about 1 year ago
CVSS Score: 9.8
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Identifiers: GHSA-6pw2-5hjv-9pf7, CVE-2021-23555
References:
- https://nvd.nist.gov/vuln/detail/CVE-2021-23555
- https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d
- https://snyk.io/vuln/SNYK-JS-VM2-2309905
- https://github.com/advisories/GHSA-6pw2-5hjv-9pf7
Blast Radius: 46.2
Affected Packages
npm:vm2
Dependent packages: 973Dependent repositories: 52,172
Downloads: 8,656,639 last month
Affected Version Ranges: < 3.9.6
Fixed in: 3.9.6
All affected versions: 0.1.0, 0.1.1, 0.2.0, 0.2.1, 0.2.2, 0.2.3, 0.2.4, 1.0.0, 1.0.1, 2.0.0, 2.0.2, 3.0.0, 3.0.1, 3.1.0, 3.2.0, 3.3.0, 3.3.1, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.5.0, 3.5.1, 3.5.2, 3.6.0, 3.6.1, 3.6.2, 3.6.3, 3.6.4, 3.6.5, 3.6.6, 3.6.7, 3.6.8, 3.6.9, 3.6.10, 3.6.11, 3.7.0, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.9.0, 3.9.1, 3.9.2, 3.9.3, 3.9.4, 3.9.5
All unaffected versions: 3.9.6, 3.9.7, 3.9.8, 3.9.9, 3.9.10, 3.9.11, 3.9.12, 3.9.13, 3.9.14, 3.9.15, 3.9.16, 3.9.17, 3.9.18, 3.9.19