CVE-2023-37466

Katalog CVE

CVSS 10.0 · Critical EPSS 3,9%

Kerentanan Improper Control of Generation of Code ('Code Injection') pada vm2 project vm2. Skor CVSS 3.1 10.0 (Critical) menurut NVD.

Deskripsi (NVD)

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.

Rincian

Terbit di NVD

14 Juli 2023

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

10.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-94: Improper Control of Generation of Code ('Code Injection')

EPSS (30 hari)

3,9% peluang dieksploitasi; lebih tinggi dari 89,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 exploit · advisory vendor
• https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744
• https://github.com/patriksimek/vm2/releases/tag/v3.10.0
• https://security.netapp.com/advisory/ntap-20241108-0002/