CVE-2022-36067

npm/vm2 CVE-2022-36067: critical 10, EPSS 47.87%

vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host

Action: Upgrade vm2 to 3.9.11 or later.

npm i vm2@3.9.11

Affected

Fixed versions

Sources

• osv: GHSA-mrgp-mrhc-5jrq
• https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
• https://nvd.nist.gov/vuln/detail/CVE-2022-36067
• https://github.com/patriksimek/vm2/issues/467
• https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71
• https://security.netapp.com/advisory/ntap-20221017-0002
• https://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067

CVE-2022-36067 · published 2022-09-28T13:09:01Z · modified 2023-11-08T04:09:59.397193Z · JSON