CVE-2022-36067

Description

vm2 vulnerable to Sandbox Escape resulting in Remote Code Execution on host

Predictions

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

No vendor mitigations ingested yet for this CVE. The mitigation-content worker queues fetches as references arrive — check back in a few minutes, or see the references list below.

References

• https://github.com/patriksimek/vm2/security/advisories/GHSA-mrgp-mrhc-5jrq
• https://nvd.nist.gov/vuln/detail/CVE-2022-36067
• https://github.com/patriksimek/vm2/issues/467
• https://github.com/patriksimek/vm2/commit/d9a7f3cc995d3d861e1380eafb886cb3c5e2b873#diff-b1a515a627d820118e76d0e323fe2f0589ed50a1eacb490f6c3278fe3698f164
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/blob/master/lib/setup-sandbox.js#L71
• https://security.netapp.com/advisory/ntap-20221017-0002
• https://www.oxeye.io/blog/vm2-sandbreak-vulnerability-cve-2022-36067