Prototype Pollution in vm2

심각 10.0CVE-2021-23449 · GHSA-rjf2-j2r6-q8gr · SNYK-JS-VM2-1585918 · Published 18/10/2021 · updated 17/06/2026

요약

CVE-2021-23449은(는) vm2 (vm2 project), vm2에 영향을 주는 심각 (CVSS 10.0) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 3.6%, 전체 취약점의 89.4%보다 높음.
조치: 3.9.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
vm2 vm2_project	`< 3.9.4`	`3.9.4`
vm2 npm	`< 3.9.4`	`3.9.4`

Description

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.

NVD description

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.

References

nvd.nist.gov/vuln/detail/CVE-2021-23449 · ADVISORY
patriksimek/vm2 · WEB
patriksimek/vm2 commit b4f6e2b · WEB
patriksimek/vm2 · PACKAGE
patriksimek/vm2 release 3.9.4 · WEB
security.netapp.com/advisory/ntap-20211029-0010 · WEB
snyk.io/vuln/SNYK-JS-VM2-1585918 · WEB
security.netapp.com/advisory/ntap-20211029-0010 · Third Party Advisory

vm2의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

vm2

vm2_project

< 3.9.4

3.9.4

vm2

npm

< 3.9.4

3.9.4

Description

This affects the package vm2 before 3.9.4. Prototype Pollution attack vector can lead to sandbox escape and execution of arbitrary code on the host machine.

NVD description

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.

vm2의 다른 취약점

모두 보기 →