ByteOS Network

NVD Vulnerability Details :

CVE-2022-39266

Modified

Source-security-advisories@github.com

Published At-29 Sep, 2022 | 18:15

Updated At-24 Aug, 2023 | 23:15

isolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Secondary	3.1	9.6	CRITICAL	CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CPE Matches

isolated-vm_project>>isolated-vm>>Versions up to 4.3.6(inclusive)

cpe:2.3:a:isolated-vm_project:isolated-vm:*:*:*:*:*:node.js:*:*

Weaknesses

CWE ID	Type	Source
CWE-20	Primary	security-advisories@github.com
CWE-693	Primary	security-advisories@github.com
CWE-20	Secondary	nvd@nist.gov
NVD-CWE-Other	Secondary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8	security-advisories@github.com	N/A
https://github.com/laverdet/isolated-vm/commits/v4.3.7	security-advisories@github.com	N/A
https://github.com/laverdet/isolated-vm/issues/379	security-advisories@github.com	N/A
https://github.com/laverdet/isolated-vm/security/advisories/GHSA-2jjq-x548-rhpv	security-advisories@github.com	Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History