CVSS 3.1
9.8 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HCVE-2022-25893
Critical (9.8) in vm2 project vm2. EPSS 1.5% chance of exploitation in the next 30 days. Fixed in vm2 3.9.10.
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Severity
- EPSS
- 1.5% chance of exploitation in the next 30 days; higher than 74% of CVEs (scores of 2026-10-31)
- CWE
- CWE-471
- Published
- Modified
- Record from
- the NVD, synced
Affected
- vm2_project:vm2
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4w2j-2rg4-5mjw | npm | vm2 | <3.9.10 | 3.9.10 |