Executive brief
vm2 is a popular sandbox library that isolates untrusted code execution in Node.js environments. A critical flaw exposes Node's shared memory Buffer pool to sandboxed code, allowing attackers to read and modify sensitive host memory. This breaks the sandbox isolation entirely, risking exposure of confidential data processed by the host and potential service disruption.
Technical details
vm2 exposes Node's Buffer object to sandboxed code by default. Small Buffer allocations (Buffer.allocUnsafe, Buffer.from, Buffer.concat) reuse a shared pool that is accessible from both the host and sandbox realms. An attacker can acquire an ArrayBuffer pointing to this shared pool and read or write to host memory, bypassing sandbox boundaries. This is an isolation/compartmentalization failure (CWE-653, CWE-668) enabling unauthorized information disclosure and potential data modification. The vulnerability affects versions before 3.11.7; no authentication or user interaction is required to exploit it. A fix is available in version 3.11.7.
Affected products
- patriksimek vm2 before 3.11.7
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-fcqc-726x-5wfc published
- 2026-09-17: advisory: CVE-2026-92947 assigned and published on NVD
- 2026: patched: Fix released in version 3.11.7