Vulnerability · Published Sep 29, 2022 · Assigned by GitHub_M

CVE-2022-39266isolated-vm has vulnerable CachedDataOptions in API

Critical 9.7

In plain English

A critical-severity improper input validation in isolated-vm from laverdet. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.3% (higher than 70% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)9.7Critical

Exploit odds (30 days)1.3%top 29.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	isolated-vm	4.3.7	GHSA-2jjq-x548-rhpv

Affected products (as reported)

Vendor	Product	Versions
laverdet	isolated-vm	<= 4.3.6

Weakness: CWE-693, CWE-20 · Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

References

https://github.com/laverdet/isolated-vm/security/advisories/GHSA-2jjq-x548-rhpv x_refsource_CONFIRM
https://github.com/laverdet/isolated-vm/issues/379 x_refsource_MISC
https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8 x_refsource_MISC
https://github.com/laverdet/isolated-vm/commits/v4.3.7 x_refsource_MISC