Quick answers
- Is CVE-2021-23555 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2021-23555 being exploited in the wild.
- How severe is CVE-2021-23555?
- Low severity, with a CVSS score of 3.1, published 12 February 2022.
- Which products and versions are affected?
- vm2 (npm) SEMVER:introduced=0,fixed=3.9.6.
- Is there a fix for CVE-2021-23555?
- Yes. vm2 (npm): upgrade to 3.9.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2021-23555 attacked?
- It is attacked over the network or with local access.
- Am I affected by CVE-2021-23555?
- Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- vm2 (npm): upgrade to 3.9.6 or later
npm install vm2@3.9.6
Technical details
vm2 before version 3.9.6 is vulnerable to sandbox bypass (CWE-1321) through direct access to host error objects created by Node.js internals during stack trace generation. The vulnerability allows an attacker to break out of the sandbox environment and gain code execution on the host machine. The attack vector is network/local depending on how vm2 is exposed, requires no authentication or user interaction, and affects all previous versions. The issue was fixed in version 3.9.6 via internal restructuring and security improvements as documented in commit 532120d.
Affected products
- vm2 vm2 before 3.9.6
Identifiers
- CVE-2021-23555
- GHSA-6pw2-5hjv-9pf7
Timeline
- 2022-02-11: disclosed: Published on NVD
- 2022-02-14: patched: Fixed in version 3.9.6