CVE-2026-92953: vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray
vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.8
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using npm/vm2 versions 3.11.0 through 3.11.7 are affected when they run attacker-controlled sandbox code. The issue affects host TypedArray and ArrayBuffer prototypes that are reachable from the sandbox.
Does exploitation require authentication, user interaction, or a complex attack path?
No. The supplied vector indicates network reachability, low attack complexity, no privileges, and no user interaction. An attacker needs the ability to execute code in a vm2 sandbox.
What is the impact after malicious sandbox code runs?
The attacker can modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype. Host-created typed arrays can then observe attacker-controlled properties after VM.run() returns, with integrity and availability impact indicated.
What version resolves the issue?
Upgrade vm2 to version 3.11.8 or later. Versions before 3.11.8 in the affected 3.11.x range are vulnerable.