You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to vulnerable library: /node_modules/vm2/package.json
Dependency Hierarchy:
pm2-5.2.2.tgz (Root Library)
agent-2.0.1.tgz
proxy-agent-5.0.0.tgz
pac-proxy-agent-5.0.0.tgz
pac-resolver-5.0.1.tgz
degenerator-3.0.2.tgz
❌ vm2-3.9.14.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed with the @@species accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.
mend-bolt-for-githubbot
changed the title
CVE-2023-37466 (Critical) detected in vm2-3.9.14.tgz
CVE-2023-37466 (Critical) detected in vm2-3.9.14.tgz - autoclosed
Aug 28, 2024
✔️ This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.
CVE-2023-37466 - Critical Severity Vulnerability
Vulnerable Library - vm2-3.9.14.tgz
Library home page: https://registry.npmjs.org/vm2/-/vm2-3.9.14.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/vm2/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19,
Promise
handler sanitization can be bypassed with the@@species
accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.Publish Date: 2023-07-14
URL: CVE-2023-37466
CVSS 3 Score Details (10.0)
Base Score Metrics:
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: