vm2 CVE-2026-92947

Requires that the host application execute attacker-controlled JavaScript inside a vm2 sandbox (version before 3.11.7) - this is vm2's core use case (plugin/eval/code-runner engines), so the condition is the deployment pattern itself rather than a special non-default toggle. There is no over-the-network vector against vm2 in isolation; the attacker must be able to get untrusted code into the VM/NodeVM. Limiting factors: applications that only run trusted code, or that have migrated off vm2 to isolated-vm, are not exposed; the flaw is fixed in 3.11.7. Because vm2 is deprecated, patching may mean migrating rather than upgrading.

The vendor assigns CVSS 4.0 10.0 (AV:N/AC:L/PR:N/UI:N with VC:H/VI:H/SC:H/SI:H), reflecting a full sandbox-boundary crossing where sandboxed code reads and writes host-realm memory. That severity is real ONLY within vm2's threat model: vm2 exists to execute untrusted JavaScript, so any host-memory read/write from inside the sandbox is a genuine security-relevant breach, not an inflated theoretical. However, the '10.0/network/unauthenticated' framing is a convention of that model - the actual precondition is that the deploying application already feeds attacker-controlled JS into a vm2 sandbox; there is no remote-over-the-wire vector against a default install. I assess the vendor's VI:H/SI:H as somewhat inflated: the primitive described (acquiring ArrayBuffers over the shared Buffer pool) is read-dominant memory disclosure (CWE-200), with write-to-host-buffers and DoS as secondary effects, so integrity/availability impact is real but lower than 'High'. No EPSS score, no CISA KEV listing, and no explicit public POC are present in the input - the GHSA advisory likely contains technical detail but weaponized exploit code is not confirmed. Net: a legitimately high-priority issue for anyone running vm2 with untrusted input, but the raw 10.0 overstates real-world blast radius given the gating threat model and the read-dominant nature of the primitive. vm2 is also deprecated/unmaintained, which raises long-term risk since the ecosystem has moved to isolated-vm.

An application uses vm2 (before 3.11.7) to run user-supplied JavaScript - e.g. a plugin engine, online code runner, or template evaluator. Attacker-supplied code inside the sandbox triggers small Buffer allocations and acquires the underlying ArrayBuffers, which alias Node's shared host Buffer pool, then reads adjacent host memory (secrets, keys, other requests' data) and writes into host-realm buffers. No public POC is identified in the provided data, though the GHSA/VulnCheck advisories describe the technique.