CVE-2022-25893

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-471

Affected software

No affected versions have been published.

Timeline

Published
Dec 21, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-258949.8All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jeCVE-2022-258957.5All versions of package lite-dev-server are vulnerable to Directory Traversal due to missing input sanitization and sandboxes being employedCVE-2022-258964.8This affects the package passport before 0.6.0. When a user logs in or logs out, the session is regenerated instead of being closed.CVE-2022-258977.5The package org.eclipse.milo:sdk-server before 0.6.8 are vulnerable to Denial of Service (DoS) when bypassing the limitations for excessive CVE-2022-258989.8The package jsrsasign before 10.5.25 are vulnerable to Improper Verification of Cryptographic Signature when JWS or JWT signature with non BCVE-2022-258999.8Authentication bypass for the Open AMT Cloud Toolkit software maintained by Intel(R) before versions 2.0.2 and 2.2.2 may allow an unauthentiCVE-2022-25907.0A race condition was found in the way the Linux kernel's memory subsystem handled the copy-on-write (COW) breakage of private read-only sharCVE-2022-259009.8All versions of package git-clone are vulnerable to Command Injection due to insecure usage of the --upload-pack feature of git.CVE-2022-259017.5Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function,CVE-2022-259037.5The package opcua from 0.0.0 are vulnerable to Denial of Service (DoS) via the ExtensionObjects and Variants objects, when it allows unlimitCVE-2022-259049.8All versions of package safe-eval are vulnerable to Prototype Pollution which allows an attacker to add or modify properties of the Object.pCVE-2022-259057.3Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolk