cyfenced.com →

[ CVE-2026-92953 · Published 17 Sep 2026 ]

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

CVSS 10.0 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)
  • Critical severity: CVSS 10.0

[ Description ]Official description

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.

[ Fixes ]Fixes and patches

  • vm2 3.11.8Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.11.8 or later (affected >= 3.11.0, <= 3.11.7)

[ Packages ]Affected open-source packages

[ References ]References