Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The package vm2 is a sandbox that can run untrusted code with Node's built-in modules. In vm2 versions prior to 3.9.18, it was possible to get a read-write reference to the node "inspect" method and edit options for "console.log". As a result, a threat actor can edit options for the "console.log" command. Users are advised to upgrade. Users unable to upgrade may make the "inspect" method read-only with "vm.readonly(inspect)" after creating a VM.
CWE-74 - Injection
Listed as the number one web application security risk on the 'OWASP Top Ten', injection attacks are widespread and dangerous, especially in legacy applications. Injection attacks are a class of vulnerabilities in which an attacker injects untrusted data into a web application that gets processed by an interpreter, altering the program's execution. This can result in data loss/theft, loss of data integrity, denial of service, and even compromising the entire system.