Remote Code Execution (RCE) Affecting vm2 package, versions *
Threat Intelligence
Exploit Maturity
Mature
EPSS
1.19% (86th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-VM2-5772825
- published 12 Jul 2023
- disclosed 12 Jul 2023
- credit SeungHyun Lee
Introduced: 12 Jul 2023
CVE-2023-37466 Open this link in a new tabHow to fix?
There is no fixed version for vm2.
Overview
vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.
Affected versions of this package are vulnerable to Remote Code Execution (RCE) such that the Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox.
Note:
According to the maintainer, the security issue cannot be properly addressed and the library will be discontinued.
References
CVSS Scores
version 3.1