Security researchers from Oxeye have discovered a critical remote code execution flaw in vm2, a JavaScript sandbox library. Tracked as CVE-2022-36067, the flaw has been given a CVSS score of 10. On successful exploitation, this flaw could allow attackers to escape the vm2 sandbox environment and run shell commands on the machine hosting the sandbox. … Continue reading “vm2 NPM Package Remote Code Execution Vulnerability (CVE-2022-36067) (Sandbreak)”
Tag: NPM Package
Node-IPC NPM Package Embedded Malicious Code Vulnerability (CVE-2022-23812)
Users of the popular Vue.js frontend JavaScript framework experienced a supply chain attack on the npm ecosystem recently. The nested dependencies Node-IPC and peacenotwar were sabotaged as a protest by the maintainer of the Node-IPC package. Regardless of the peace-not-war slogan, node-ipc is now being identified as a malicious package, including malicious code that … Continue reading “Node-IPC NPM Package Embedded Malicious Code Vulnerability (CVE-2022-23812)”