| Package | Affected versions | Patched versions |
|---|---|---|
| vm2 | < 3.9.10 | 3.9.10 |
| vm2 | < 3.9.10 | 3.9.10 |
The package vm2 before 3.9.10 is vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free