CVE-2022-25893

CRITICAL

vm2 <3.9.10 - RCE

Title source: llm
STIX 2.1

Description

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

References (4)

Core 4
Core References
Exploit, Issue Tracking, Third Party Advisory
https://github.com/patriksimek/vm2/issues/444
Patch, Third Party Advisory
https://github.com/patriksimek/vm2/pull/445
Exploit, Patch, Third Party Advisory
https://security.snyk.io/vuln/SNYK-JS-VM2-2990237

Scores

CVSS v3 9.8
EPSS 0.0050
EPSS Percentile 65.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-471
Status published
Products (2)
npm/vm2 0 - 3.9.10npm
vm2_project/vm2 < 3.9.10
Published Dec 21, 2022
Tracked Since Feb 18, 2026