CyberRota Analysis
AI-GeneratedThe vulnerability in vm2 prior to version 3.11.8 allows attackers to escape the sandbox environment, gaining unauthorized access to the host's prototype properties via console outputs. This enables them to manipulate core Node.js functionalities, potentially executing arbitrary code within the process context and bypassing security restrictions. Organizations using affected versions of vm2 should prioritize immediate updates to mitigate this critical risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr. Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions.