CVE-2022-39266

Katalog CVE

CVSS 9.8 · Critical EPSS 1,3%

Kerentanan Improper Input Validation pada isolated-vm project isolated-vm. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.

Rincian

Terbit di NVD

29 September 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-693: Protection Mechanism Failure

EPSS (30 hari)

1,3% peluang dieksploitasi; lebih tinggi dari 69,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/laverdet/isolated-vm/security/advisories/GHSA-2jjq-x548-rhpv advisory pihak ketiga
• https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8
• https://github.com/laverdet/isolated-vm/commits/v4.3.7
• https://github.com/laverdet/isolated-vm/issues/379