Sign in
Deutsch English Español Polski
Critical

vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

  • Disclosed: 05.10.2026
  • Updated: 11.10.2026 10:22

Summary

Sandboxed code is able to disclose host memory used by small allocations by Buffer.from, Buffer.concat.

Details

vm2 exposes Buffer object to sandboxed code by default. Small Buffer allocations (for example, Buffer.allocUnsafe(), Buffer.from(array), Buffer.from(string), and Buffer.concat()) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.

PoC

Tested against vm2@3.11.5 in the node REPL.

js
Buffer.from('host-memory-should-not-leak-to-sandbox')
new (require('vm2').VM)().run(`Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString('ascii')`)
<img width="1044" height="104" alt="Screenshot 2026-07-23 at 17 54 15" src="https://github.com/user-attachments/assets/987b860c-6702-4818-bfaa-c77919c777e5" />

Impact

Since sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-of-service.

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
npm package vm2 < 3.11.7 3.11.7

References

CVSS score 10/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness (CWE)
CWE-200, CWE-653, CWE-668
Platform
npm
Package
vm2
Disclosed
05.10.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-fcqc-726x-5wfc - CC BY 4.0

Vulnerability history: vm2

All published vulnerabilities of this package (npm package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (78) in the archive
Total entries
78
First → latest
10.2021 10.2026
Without a fix
1
Exploited in attacks
0

Severity breakdown

  • Critical 51
  • High 14
  • Medium 12
  • Low 1

Disclosures per year

Severity:
  1. vm2 contains a sandbox escape vulnerability
    Critical · 10.0 CVE-2026-93605 < 3.12.1 3.12.1
  2. vm2: NodeVM custom resolution bypasses external path boundaries
    Critical · 10.0 CVE-2026-100721 < 3.12.2 3.12.2
  3. vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
    High · 8.6 CVE-2026-100722 < 3.12.2 3.12.2
  4. vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
    High · 7.1 CVE-2026-92959 < 3.11.8 3.11.8
  5. vm2: Sandbox Escape (NodeVM)
    Critical · 10.0 CVE-2026-92955 < 3.11.8 3.11.8
  6. vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host process
    Critical · 8.6 CVE-2026-92954 >= 3.10.0, < 3.11.8 3.11.8
  7. vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix
    Critical · 10.0 CVE-2026-92953 >= 3.11.0, < 3.11.8 3.11.8
  8. vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit
    Critical · 9.0 CVE-2026-92934 < 3.11.8 3.11.8
  9. vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)
    High · 7.5 CVE-2026-92942 < 3.11.7 3.11.7
  10. vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
    Critical · 10.0 CVE-2026-92946 < 3.11.7 3.11.7
  11. vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool this entry
    Critical · 10.0 CVE-2026-92947 < 3.11.7 3.11.7
  12. vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypass
    Critical · 10.0 CVE-2026-92956 >= 3.10.1, < 3.11.7 3.11.7
  13. vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape
    Critical · 9.9 CVE-2026-92948 >= 3.9.6, < 3.11.7 3.11.7
  14. vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts
    High · 8.6 CVE-2026-92950 < 3.11.7 3.11.7
  15. vm2 exposes host HTTPS credentials and TLS traffic through globalAgent
    Critical · 10.0 CVE-2026-92940 >= 3.11.3, < 3.11.7 3.11.7
  16. vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
    Critical · 9.9 CVE-2026-92951 < 3.11.7 3.11.7
  17. vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes
    High · 8.5 CVE-2026-92958 < 3.11.7 3.11.7
  18. vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process
    Critical · 9.9 CVE-2026-92957 < 3.11.7 3.11.7
  19. vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE
    Critical · 9.0 CVE-2026-92935 >= 3.11.4, < 3.11.7 3.11.7
  20. vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection
    Critical · 10.0 CVE-2026-92937 >= 3.11.6, < 3.11.7 3.11.7
  21. vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
    Critical · 9.9 CVE-2026-92938 >= 3.11.3, < 3.11.7 3.11.7
  22. vm2 crypto builtin loads attacker native code through setEngine
    Critical · 9.9 CVE-2026-92939 >= 3.11.3, < 3.11.7 3.11.7
  23. vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector
    Critical · 9.8 CVE-2026-92944 >= 3.10.2, < 3.11.7 3.11.7
  24. vm2 NodeVM can replace the host process TLS trust store
    Critical · 10.0 CVE-2026-92941 >= 3.11.3, < 3.11.7 3.11.7
  25. vm2 has Memory Exhaustion DoS via bufferAllocLimit Bypass
    High · 7.5 CVE-2026-92961 < 3.11.6 3.11.6
  26. vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)
    Critical · 10.0 CVE-2026-92960 < 3.11.6 3.11.6
  27. vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
    Critical · 9.8 CVE-2026-47698 < 3.11.6 3.11.6
  28. VM2 has Missing Error.cause Sanitization that Enables Sandbox Escape to RCE
    Critical · 9.9 CVE-2026-47686 < 3.11.6 3.11.6
  29. vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
    High CVE-2026-47683 < 3.11.6 3.11.6
  30. NodeVM network builtin exclusions bypass via internal _http_client and _http_server
    High · 8.6 CVE-2026-47139 < 3.11.4 3.11.4
  31. NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
    Critical · 10.0 CVE-2026-47140 < 3.11.4 3.11.4
  32. vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
    Critical · 9.8 CVE-2026-47210 < 3.11.4 3.11.4
  33. vm2 has a CVE-2023-37903 patch bypass: nesting:true without explicit require still allows full RCE
    Critical · 10.0 CVE-2026-47137 < 3.11.4 3.11.4
  34. vm2's Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
    High · 8.6 CVE-2026-47209 < 3.11.4 3.11.4
  35. vm2 has a sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
    High · 8.7 CVE-2026-47135 < 3.11.4 3.11.4
  36. vm2 is Vulnerable to Sandbox Breakout Through Promise Species
    Critical · 10.0 CVE-2026-47208 < 3.11.4 3.11.4
  37. vm2 has a Sandbox Escape issue
    Critical · 10.0 CVE-2026-47131 < 3.11.4 3.11.4
  38. vm2 Has a Sandbox Breakout Using Async Generator
    Critical · 9.8 CVE-2026-45411 < 3.11.3 3.11.3
  39. vm2 has Sandbox Breakout Through Null Proto Exception
    Critical · 9.8 CVE-2026-44009 < 3.11.2 3.11.2
  40. vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
    Critical · 9.8 CVE-2026-44008 < 3.11.2 3.11.2
Show more (20) Showing 40 of 65

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.