VDB
Sign up
CRITICAL9.8

GHSA-4w2j-2rg4-5mjw

vm2 vulnerable to Arbitrary Code Execution

Quick fix

GHSA-4w2j-2rg4-5mjw — vm2: upgrade to the fixed version with the command below.

npm install vm2@3.9.10

Details

The package vm2 before 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/vm2
Introduced in: 0Fixed in: 3.9.10
Fixnpm install vm2@3.9.10

References