Skip to main content

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVE-2023-32313

Medium
5.3/10

Summary

The package vm2 is a sandbox that can run untrusted code with Node's built-in modules. In vm2 versions prior to 3.9.18, it was possible to get a read-write reference to the node "inspect" method and edit options for "console.log". As a result, a threat actor can edit options for the "console.log" command. Users are advised to upgrade. Users unable to upgrade may make the "inspect" method read-only with "vm.readonly(inspect)" after creating a VM.

  • LOW
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • NONE

CWE-74 - Injection

Listed as the number one web application security risk on the 'OWASP Top Ten', injection attacks are widespread and dangerous, especially in legacy applications. Injection attacks are a class of vulnerabilities in which an attacker injects untrusted data into a web application that gets processed by an interpreter, altering the program's execution. This can result in data loss/theft, loss of data integrity, denial of service, and even compromising the entire system.

References

Advisory Timeline

  • Published