CVE-2022-25893

Katalog CVE

CVSS 9.8 · Critical EPSS 1,5%

Kerentanan Modification of Assumed-Immutable Data (MAID) pada vm2 project vm2. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Rincian

Terbit di NVD

21 Desember 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-471: Modification of Assumed-Immutable Data (MAID)

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/patriksimek/vm2/pull/445 patch · advisory pihak ketiga
• https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69 patch · advisory pihak ketiga
• https://security.snyk.io/vuln/SNYK-JS-VM2-2990237 exploit · patch · advisory pihak ketiga
• https://github.com/patriksimek/vm2/issues/444 exploit · issue tracking · advisory pihak ketiga