CVE-2021-23449

9.8

CRITICALCVSS v3

Published

October 18, 2021

CVSS v2

7.5 HIGH

Affected

2 projects

Assigned by

Severity scale

010

Description

This affects the package vm2 before 3.9.4 via a Prototype Pollution attack vector, which can lead to execution of arbitrary code on the host machine.

NPMvm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

< 3.9.4OSV

GitHubAdvanced vm/sandbox for Node.js

< 3.9.4NVD