Quick answers
- Is CVE-2019-10761 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2019-10761 being exploited in the wild.
- How severe is CVE-2019-10761?
- Low severity, with a CVSS score of 3.1, published 14 July 2022.
- Which products and versions are affected?
- vm2 (npm) SEMVER:introduced=0,fixed=3.6.11.
- Is there a fix for CVE-2019-10761?
- Yes. vm2 (npm): upgrade to 3.6.11 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2019-10761 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2019-10761?
- Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- vm2 (npm): upgrade to 3.6.11 or later
npm install vm2@3.6.11
Technical details
The vulnerability is a sandbox escape (CWE-674: Uncontrolled Recursion) caused by improper handling of stack limit errors. An attacker can trigger infinite recursion to cause a RangeError exception that originates from the host context rather than the sandboxed context. When this uncontextified RangeError is returned to the sandbox, the attacker can access its constructor chain to gain a reference to the host's mainModule and execute arbitrary code via require("child_process"). This requires no authentication and is triggered by running untrusted code within the VM context. The vulnerability is fixed in vm2 version 3.6.11 and later.
Affected products
- vm2 vm2 before 3.6.11
Identifiers
- CVE-2019-10761
- GHSA-wf5x-cr3r-xr77
Timeline
- 2019-04-07: disclosed
- 2022-07-13: patched: Version 3.6.11 released