GHSA-fcqc-726x-5wfc: Infoleak
Summary Sandboxed code is able to disclose host memory used by small allocations by Buffer.from, Buffer.concat.
Details vm2 exposes Buffer object to sandboxed code by default. Small Buffer allocations (for example, Buffer.allocUnsafe(), Buffer.from(array), Buffer.from(string), and Buffer.concat()) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.
PoC Tested against vm2@3.11.5 in the node REPL. javascript Buffer.from('host-memory-should-not-leak-to-sandbox') new (require('vm2').VM)().run(Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString('ascii'))
<img width="1044" height="104" alt="Screenshot 2026-07-23 at 17 54 15" src="https://github.com/user-attachments/assets/987b860c-6702-4818-bfaa-c77919c777e5" />
Impact Since sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-of-service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/vm2to a version that resolves this vulnerability.Fixed in 3.11.7
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/vm2 that run untrusted or less-trusted code in a VM are exposed, because that sandboxed code can access the Buffer object. The disclosure concerns host memory associated with small Buffer-pool allocations.
What does an attacker need to exploit it?
An attacker needs the ability to execute code inside a vm2 sandbox. No privileges or user interaction are indicated by the provided severity vector.
Is the default sandbox configuration affected?
Yes. vm2 exposes Buffer to sandboxed code by default, allowing sandbox code to access the shared Buffer pool.
What data could be disclosed?
Sandboxed code may disclose host memory used by small allocations made through Buffer.allocUnsafe(), Buffer.from(array), Buffer.from(string), or Buffer.concat(). The provided proof of concept was tested with vm2 version 3.11.5.