Skip to main content

Remote code execution vulnerability present in vm2 sandbox

The ACSC is aware of a remote code execution vulnerability in vm2 sandbox versions prior to 3.9.11. Affected Australian organisations should apply the available patch immediately.

Alert status
CRITICAL

Background / What has happened?

A remote code execution vulnerability (CVE-2022-36067) has been identified in vm2 sandbox versions prior to 3.9.11.

vm2 is a commonly used software testing framework. The popular Javascript sandbox library has at least 16 million monthly downloads.

Exploitation of this vulnerability could allow a malicious actor to bypass the sandbox protections to gain remote code execution rights on the host running the sandbox and perform unauthorised actions.

Affected Australian organisations should apply the available patch immediately.

The ACSC is not aware of any successful exploitation attempts against Australian organisations.

Mitigation / How do I stay secure?

Australian organisations that use vm2 sandbox versions prior to 3.9.11 should review their patch status and update to the latest version. There are no known workarounds.

Assistance / Where can I go for help?

The ACSC is monitoring the situation and can provide assistance and advice as required. Organisations that have been impacted or require assistance can contact the ACSC via 1300 CYBER1.

 

Was this information helpful?
Was this information helpful?

Thanks for your feedback!

 
Optional

Tell us why this information was helpful and we’ll work on making more pages like it