CyberRota Analysis
AI-GeneratedThe vm2 library for Node.js is vulnerable due to inadequate protections against stacked indirection, which allows malicious sandbox code to manipulate host prototype chains and execute arbitrary commands. This critical vulnerability poses a significant risk to applications using affected versions prior to 3.11.6, as it can lead to unauthorized access and control over the host environment. Organizations utilizing vm2 should prioritize upgrading to version 3.11.6 or later to mitigate this severe security threat.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, lib/bridge.js and lib/setup-sandbox.js fail to block stacked indirection through Function.prototype.call around dangerous host prototype getter and setter mutators, allowing sandbox code to sever a host intrinsic's prototype chain and reach e.constructor.constructor for arbitrary host command execution. This issue is fixed in version 3.11.6.