Description (CNA)
The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of a stacktraces, which can lead to execution of arbitrary code on the host machine.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| n/a / vm2 | affected unspecified before 3.9.6 |
CWE
No CWE identifiers supplied.
References
- https://snyk.io/vuln/SNYK-JS-VM2-2309905
- https://github.com/patriksimek/vm2/commit/532120d5cdec7da8225fc6242e154ebabc63fe4d
ADP enrichment
No English description supplied.