CVE-2022-25893

Published: Dec 21, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Affected (1)

Products: Vm2 Project: Vm2

Vm2 Project

1 product

Vm2

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Vm2 Project Vm2	Before 3.9.10

Related CWEs

CWE-471

Modification of Assumed-Immutable Data (MAID)

The product does not properly protect an assumed-immutable element from being modified by an attacker.

References (8)

https://github.com/patriksimek/vm2/issues/444

Source: report@snyk.io

ExploitIssue TrackingThird Party Advisory

https://github.com/patriksimek/vm2/pull/445

Source: report@snyk.io

PatchThird Party Advisory

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69

Source: report@snyk.io

PatchThird Party Advisory

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237

Source: report@snyk.io

ExploitPatchThird Party Advisory

https://github.com/patriksimek/vm2/issues/444

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitIssue TrackingThird Party Advisory

https://github.com/patriksimek/vm2/pull/445

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://security.snyk.io/vuln/SNYK-JS-VM2-2990237

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitPatchThird Party Advisory

Timeline

No history available yet.