PT-2022-9410 · Vm2 · Vm2

Abdullah Alhamdan + 1 · Published 2022-02-11 · Updated 2022-02-22 · CVE-2021-23555

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.9.6

Description The issue allows for Sandbox Bypass via direct access to host error objects generated by node internals during generation of stacktraces. This can lead to execution of arbitrary code on the host machine.

Recommendations For versions prior to 3.9.6, update to version 3.9.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the vm2 package until a patch is applied.

Exploit

Fix

Prototype Pollution

Weakness Enumeration

CWE-1321

Related Identifiers

CVE-2021-23555

GHSA-6PW2-5HJV-9PF7

SNYK-JS-VM2-2309905

Affected Products

Vm2

References · 10

• 🔥 https://snyk.io/vuln/SNYK-JS-VM2-2309905 · Exploit
• https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-23555 · Security Note
• https://osv.dev/vulnerability/GHSA-6pw2-5hjv-9pf7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23555 · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://t.me/cvenotify/26700 · Telegram Post
• https://t.me/cvenotify/26697 · Telegram Post
• https://t.me/cvenotify/27172 · Telegram Post
• https://t.me/cibsecurity/37347 · Telegram Post