CVE-2022-25893
1 advisory.
npm/vm2 CVE-2022-25893: critical 9.8, EPSS 1.54%
vm2 vulnerable to Arbitrary Code Execution
Action: Upgrade vm2 to 3.9.10 or later.
npm i vm2@3.9.10Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 3.9.10 | - |
Fixed versions
| 3.9.10 |
Sources
- osv: GHSA-4w2j-2rg4-5mjw
- https://nvd.nist.gov/vuln/detail/CVE-2022-25893
- https://github.com/patriksimek/vm2/issues/444
- https://github.com/patriksimek/vm2/pull/445
- https://github.com/patriksimek/vm2/pull/445/commits/3a9876482be487b78a90ac459675da7f83f46d69
- https://github.com/patriksimek/vm2
- https://security.snyk.io/vuln/SNYK-JS-VM2-2990237
CVE-2022-25893 · published · modified · JSON