Description
The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | vm2 | unspecified – < 3.9.10 | 3.9.10 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | vm2 | < 3.9.10 | 3.9.10 | GHSA-4w2j-2rg4-5mjw |