Prototype Pollution in vm2
This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-23449US | critical10.0 | — | ||
This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine. | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/patriksimek/vm2PACKAGE
- https://github.com/patriksimek/vm2/commit/b4f6e2bd2c4a1ef52fc4483d8e35f28bc4481886WEB
- https://github.com/patriksimek/vm2/issues/363WEB
- https://github.com/patriksimek/vm2/releases/tag/3.9.4WEB
- https://nvd.nist.gov/vuln/detail/CVE-2021-23449ADVISORY
- https://security.netapp.com/advisory/ntap-20211029-0010WEB
- https://snyk.io/vuln/SNYK-JS-VM2-1585918WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan