What is GHSA-2jjq-x548-rhpv?

GHSA-2jjq-x548-rhpv is a security advisory published by GitHub Security Advisories with Critical severity. isolated-vm has vulnerable CachedDataOptions in API

Which CVE IDs does GHSA-2jjq-x548-rhpv cover?

GHSA-2jjq-x548-rhpv covers the following CVE IDs: CVE-2022-39266. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-2jjq-x548-rhpv?

GHSA-2jjq-x548-rhpv has a CVSS v3 base score of 9.6, published by GitHub Security Advisories.

Which products are affected by GHSA-2jjq-x548-rhpv?

GHSA-2jjq-x548-rhpv affects 1 product, including: npm/isolated-vm:\u003c= 4.3.6.

GHSA-2jjq-x548-rhpvCriticalCVSS 9.6

isolated-vm has vulnerable CachedDataOptions in API

Vendor

GitHub Security Advisories

Published

September 30, 2022

Last Modified

August 24, 2023

🔗 CVE IDs covered (1)

CVE-2022-39266 →

📋 Description

Impact

If the untrusted v8 cached data is passed to the API through CachedDataOptions, the attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept cachedData payloads from a user.

🎯 Affected products1

npm/isolated-vm:<= 4.3.6

🔗 References (6)

https://github.com/laverdet/isolated-vm/security/advisories/GHSA-2jjq-x548-rhpv
https://nvd.nist.gov/vuln/detail/CVE-2022-39266
https://github.com/laverdet/isolated-vm/issues/379
https://github.com/laverdet/isolated-vm/commit/218e87a6d4e8cb818bea76d1ab30cd0be51920e8
https://github.com/laverdet/isolated-vm/commits/v4.3.7
https://github.com/advisories/GHSA-2jjq-x548-rhpv