CVE-2022-39266

MITRE NVD CVE.ORG JSON API Print: PDF PDF

Summary

CVECVE-2022-39266
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2022-09-29 18:15:00 UTC
Updated2023-08-24 23:15:00 UTC
Descriptionisolated-vm is a library for nodejs which gives the user access to v8's Isolate interface. In versions 4.3.6 and prior, if the untrusted v8 cached data is passed to the API through CachedDataOptions, attackers can bypass the sandbox and run arbitrary code in the nodejs process. Version 4.3.7 changes the documentation to warn users that they should not accept `cachedData` payloads from a user.

Risk And Classification

Problem Types: CWE-20 | CWE-693

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Application Isolated-vm Project Isolated-vm All All All All

References

ReferenceSourceLinkTags
Status regarding CVE-2022-39266 · Issue #379 · laverdet/isolated-vm · GitHub MISC github.com
Commits · laverdet/isolated-vm · GitHub MISC github.com
Vulnerable CachedDataOptions in API · Advisory · laverdet/isolated-vm · GitHub CONFIRM github.com
Add note about `cachedData` · laverdet/isolated-vm@218e87a · GitHub MISC github.com
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report