MediumGHSA-p5gc-c584-jj6vCVE-2023-32313

vm2 vulnerable to Inspect Manipulation

Published 17 May 2023 · Updated 10 Sept 2026

Affected package

vm2npm
Affected
<3.9.18
Fixed in
3.9.18
Update to the fixed version for your release line, for example:npm install vm2@3.9.18

Details

In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node inspect method and edit options for console.log.

Impact

A threat actor can edit options for console.log.

Patches

This vulnerability was patched in the release of version 3.9.18 of vm2.

Workarounds

After creating a vm make the inspect method readonly with vm.readonly(inspect).

References

PoC - https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550

For more information

If you have any questions or comments about this advisory:

  • Open an issue in VM2

Thanks to @arkark (Takeshi Kaneko) of GMO Cybersecurity by Ierae, Inc. for disclosing this vulnerability.

Is GHSA-p5gc-c584-jj6v in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected vm2, and gives you the command that fixes it.

Scan a project free, no signupOr connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.