PT-2021-15533 · Vm2 · Vm2

Abdullah Alhamdan + 1 · Published 2021-10-18 · Updated 2021-11-04 · CVE-2021-23449

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.9.4

Description The issue is related to a Prototype Pollution attack vector, which can lead to sandbox escape and execution of arbitrary code on the host machine. This allows for the execution of arbitrary code on the host machine, posing a significant security risk.

Recommendations For versions prior to 3.9.4, update to version 3.9.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of the vm2 package until a patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-915

CWE-1321

Related Identifiers

CVE-2021-23449

GHSA-RJF2-J2R6-Q8GR

SNYK-JS-VM2-1585918

Affected Products

Vm2

References · 10

• 🔥 https://snyk.io/vuln/SNYK-JS-VM2-1585918 · Exploit
• https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886 · Patch
• https://osv.dev/vulnerability/CVE-2021-23449 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-23449 · Security Note
• https://osv.dev/vulnerability/GHSA-rjf2-j2r6-q8gr · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/issues/363 · Note
• https://github.com/patriksimek/vm2/releases/tag/3.9.4 · Note
• https://security.netapp.com/advisory/ntap-20211029-0010 · Note
• https://t.me/cibsecurity/30724 · Telegram Post