CVE-2022-25893

Arbitrary Code Execution

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Affected

vm2

CVSS v3.1 NVD

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

1.49% chance of exploitation in the next 30 days, 74th percentile

Published

2022-12-21

Updated

2025-04-15

Proof-of-concept exploits (1)

• https://security.snyk.io/vuln/SNYK-JS-VM2-2990237

Security advisories

• patriksimek/vm2/issues/444
• advisories/GHSA-4w2j-2rg4-5mjw

References

• CVE Record
• NVD entry