Medium severity - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in vm2 (package.json)

[github-actions]

• Package Manager: npm
• Vulnerable module: vm2
• Introduced through: juice-shop@12.3.0, juicy-chat-bot@0.6.6 and others

Detailed paths

• Introduced through: juice-shop@12.3.0 › juicy-chat-bot@0.6.6 › vm2@3.9.11

Overview

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') via the inspect method of vm.js, which allows write permissions.
Exploiting this vulnerability allows an attacker to edit options for the console.log command.

Workaround

Users unable to upgrade may make the inspect method readonly with vm.readonly(inspect) after creating a VM.

Remediation

Upgrade vm2 to version 3.9.18 or higher.

References

• GitHub Commit
• GitHub Release
• PoC
  
  SNYK-JS-VM2-5537079
  (CVE-2023-32313) vm2@3.9.11