Published: 14/07/2023 Updated: 01/02/2024

CVSS v3 Base Score: 10 | Impact Score: 6 | Exploitability Score: 3.9

VMScore: 0

vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing malicious users to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.

Vulnerable Product	Search on Vulmon	Subscribe to Product
vm2 project vm2

概述 Critical: Red Hat Advanced Cluster Management 281 security and bug fix updates 类型/严重性 Security Advisory: Critical 标题 Red Hat Advanced Cluster Management for Kubernetes 281 GeneralAvailability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security ...

Synopsis Critical: Multicluster Engine for Kubernetes 231 security updates and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 231 General Availability release images, which contain security updates and fix bugsRed Hat Product Security has rated this update as having a security impactof Critic ...

Synopsis Critical: Red Hat Advanced Cluster Management 267 security and bug fix updates Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 267 GeneralAvailability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security i ...

Synopsis Critical: Red Hat Advanced Cluster Management 277 security and bug fix updates Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 277 GeneralAvailability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security i ...

Synopsis Critical: Multicluster Engine for Kubernetes 218 security updates and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 218 General Availability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security impactof Critica ...

vm2 versions 3919 and below suffer from a sandbox escape vulnerability ...

CWE-94 https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 https://nvd.nist.gov https://access.redhat.com/errata/RHSA-2023:4875

CVE-2023-37466

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

References

Vulmon Search

About

Products

Connect