vm2 CVE-2026-92953

Exploitation requires that the host application embed vm2 (versions 3.11.0 through 3.11.7) and execute attacker-controlled JavaScript inside a VM/NodeVM sandbox, then subsequently create or operate on host-side TypedArray/ArrayBuffer instances whose polluted prototype properties are observable. The vulnerability is inherent to any such configuration (no non-default option is named as a prerequisite), but it is fundamentally gated by the vm2 usage model: applications that do NOT run untrusted code in vm2, or that never touch host typed arrays after sandbox execution, are not exploitable. The limiting factor is therefore the deliberate deployment of vm2 as an untrusted-code sandbox - not a special feature flag.

The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VI:H/VA:H plus subsequent-system SI:H/SA:H) rates this 9.3 Critical, reflecting a sandbox-escape-class prototype pollution where mutations to host TypedArray/ArrayBuffer prototypes persist into the host realm after VM.run() returns - a genuine scope change affecting the subsequent (host) system. However, this is a library-embedded vulnerability whose real-world risk is entirely conditional on the vm2 threat model: it only matters where an application deliberately executes untrusted/attacker-supplied JavaScript inside a vm2 sandbox and later handles host-created typed arrays. There is no EPSS score, no CISA KEV listing, and no explicitly published exploit in the provided data (a working technique is likely described in the GHSA advisory but is not confirmed as standalone POC). Notably, the vendor tags this 'Information Disclosure', which directly conflicts with the CVSS vector setting VC:N (no confidentiality impact) - the actual impact is integrity and availability, so treat the tag as mislabeled. One data caveat: the stated fix version 3.11.8 does not match vm2's public release history (the project stopped around 3.9.19 and was deprecated in 2023), so the version metadata should be verified against the advisory. Net: a legitimately high-severity flaw for the narrow population that still runs vm2 with untrusted code, but not a broad internet-facing emergency absent that specific usage.

An application uses vm2 (3.11.0-3.11.7) to run untrusted user-supplied JavaScript - e.g. a code playground, template evaluator, or serverless function runner. Malicious sandboxed code walks prototype chains to reach and mutate host Uint8Array.prototype/%TypedArray%.prototype/ArrayBuffer.prototype, so that after VM.run() returns, host code operating on its own typed arrays observes attacker-controlled properties, corrupting host-side data handling or logic. No public standalone exploit is confirmed, though the GHSA advisory likely details the prototype-walking primitive.