ghsa:GHSA-GG6F-MHQM-F7GP: vm2 <= 3.11.7

Affected technology

vm2 · <= 3.11.7
Vendor not specified by the source

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can overwrite EventEmitter.prototype.emit and trigger process events to execute code with process context, bypassing code generation restrictions. Source advisory’s CVSS 3.1 assessment rates confidentiality, integrity and availability impact as high.