by Kastro
Paper/Archive/CVE-2022-25893

CVE-2022-25893

snyk — Arbitrary Code Execution

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
54
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 74.9.749 × 2015.0Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Affected

ProductAffectedFixed inSource
vm2unspecified – < 3.9.103.9.10CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
snyk (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

refsecurity.snyk.io/vuln/SNYK-JS-VM2-2990237refgithub.com/patriksimek/vm2/issues/444refgithub.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69refgithub.com/patriksimek/vm2/pull/445