vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2. There are no known workarounds.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. In versions prior
    to version 3.9.11, a threat actor can bypass the sandbox protections to gain remote code execution rights
    on the host running the sandbox. This vulnerability was patched in the release of version 3.9.11 of vm2.
    There are no known workarounds. (CVE-2022-36067)

The version of the Node.js module vm2 installed on the remote host is prior to 3.9.11. It is, therefore affected by a sandbox breakout vulnerability. Untrusted code can break out of the sandbox created by the affected vm2 module and execute arbitrary code on the host system.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
417114	SCA: security update for vm2 (GHSA-mrgp-mrhc-5jrq)	Tenable Cloud Security	SCA Checks	Local	critical
417114	SCA: security update for vm2 (GHSA-mrgp-mrhc-5jrq)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
173678	Node.js Module vm2 < 3.9.11 Sandbox Breakout	Nessus	Misc.	Local	critical

Detections

Analytics

CVE-2022-36067

critical

Tenable Plugins

critical

critical

critical