VDB
BDU%3A2023-02119
BDU%3A2023-02119
PUBLISHED
CVSS 9.800000190734863 CRITICAL
Уязвимость преобразователя исходного кода библиотеки vm2 пакетного менеджера NPM, позволяющая нарушителю выйти из изолированной программной среды и выполнить произвольный код
Risk Scores
CVSS 3.1
9.800000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Node.js Foundation | vm2 | |
| patriksimek | vm2 | < 3.9.16 |
Timeline
- Apr 14, 2023 CVE Published
- Apr 14, 2023 PoC Published
- Apr 18, 2023 PoC Published
- Apr 19, 2023 PoC Published
- Sep 13, 2024 CVE Updated
- Aug 31, 2025 PoC Published
- Aug 31, 2025 PoC Published
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-xj72-wvfv-8985 url
- https://github.com/patriksimek/vm2/commit/24c724daa7c09f003e556d7cd1c7a8381cb985d7 url
- https://gist.github.com/leesh3288/f05730165799bf56d70391f3d9ea187c url
- https://github.com/patriksimek/vm2/releases/tag/3.9.16 url
- https://github.com/patriksimek/vm2/issues/516 url