Description

The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.

Remediation

References

https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d

https://snyk.io/vuln/SNYK-JS-VM2-2309905

Related Vulnerabilities

CVE-2023-40809 Vulnerability in maven package org.opencrx:opencrx-core-models

CVE-2018-15756 Vulnerability in maven package org.springframework:spring-web

CVE-2018-11040 Vulnerability in maven package org.springframework:spring-webmvc

CVE-2019-16869 Vulnerability in maven package org.jboss.netty:netty

CVE-2021-21119 Vulnerability in npm package electron

Severity

Critical

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Patch Third Party Advisory Exploit NVD-CWE-noinfo