Executive brief
vm2 is a popular sandbox library that isolates untrusted JavaScript code. An attacker running code inside a default vm2 sandbox can bypass isolation protections and pollute the host application's TypedArray and ArrayBuffer prototypes, causing the host's typed-array objects to execute malicious code or observe attacker-controlled properties after the sandboxed code exits. This violates the core security boundary between sandbox and host.
Technical details
vm2 protects host object prototypes from sandbox mutation via a bridge mechanism that maintains a list of protected host intrinsics. However, the inventory omits TypedArray.prototype, ArrayBuffer.prototype, and related typed-array family prototypes. An attacker can use prototype-walking primitives (via Buffer.__proto__ lookups) to reach and mutate these unprotected host prototypes, causing Reflect.defineProperty() calls to forward into the real host objects rather than sandbox-local copies. No special privileges, NodeVM mode, or host-provided typed arrays are required. The fix is to extend the protected inventory to include all typed-array and binary-data intrinsics and apply the same mutation guards (set, defineProperty, deleteProperty, preventExtensions). Patches are available in version 3.11.8 and later.
Affected products
- Patriksimek vm2 3.11.0 before 3.11.8
Timeline
- 2026-08-27: disclosed: Security advisory GHSA-3vgf-8m4q-q4qr published on GitHub
- 2026-09-17: advisory: CVE-2026-92953 published and indexed in NVD
- 2026: patched: Version 3.11.8 released with fix