Cyber Resilience

CVE-2022-25893

CriticalPublic PoC

Published: 21 December 2022

Published
21 December 2022
Modified
15 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0050 66.2th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2022-25893 is a critical-severity MAID (CWE-471) vulnerability in Vm2 Project Vm2. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 33.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

The package vm2 before 3.9.10 are vulnerable to Arbitrary Code Execution due to the usage of prototype lookup for the WeakMap.prototype.set method. Exploiting this vulnerability leads to access to a host object and a sandbox compromise.

CWE(s)
NVD-CWE-noinfoCWE-471

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

vm2 project
vm2
≤ 3.9.10

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

SC-33 Transmission Preparation Integrity
addresses: CWE-471

Checksums and integrity protection during transformation/packing detect unauthorized modification of data assumed to be immutable before it is transmitted.

References