Threat Investigation
Request a demo

CVE-2022-25893

Critical

Description

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

SeverityCritical
CVSS9.8
Exploit probability—
ProductVm2
PublishedDec 21, 2022
First seenDec 21, 2022
Weakness typeCWE-471CWE-471

How to fix

Update
  • vm2_project vm23.9.10 or later
  • vm23.9.10 or later

Affected products

ProductAffected versionsFixed in
vm2_project vm2v < 3.9.103.9.10
vm2npmv < 3.9.103.9.10

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.