CVE-2026-92953

CRITICALCVSS 10.0

Description

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.

Timeline

Published:September 17th, 2026 2:18 PM

Last modified:September 18th, 2026 8:17 PM

CVSS Scoring

CVSS v3: 10.0 (CRITICAL)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Weaknesses (CWE)

CWE-913

References & Reports

Advisories, patches, and third-party reports

https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr
https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray
https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr

Source: NIST NVD · Data may lag official sources by up to one minute