Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

🗓️ 17 Sep 2026 15:32:16Reported by GitHub Advisory DatabaseType

Sandbox mutation in vm2 lets attackers modify host TypedArray and ArrayBuffer prototypes.

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerabilities of the functions Uint8Array.prototype(), TypedArray.prototype(), and ArrayBuffer.prototype() in the NPM package manager vm2 package allow a hacker to execute arbitrary code.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92953	17 Sep 202616:10	–	circl
CVE	CVE-2026-92953	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81602	5 Oct 202622:45	–	euvd
Github Security Blog	vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	5 Oct 202622:45	–	github
NVD	CVE-2026-92953	17 Sep 202614:18	–	nvd
OSV	GHSA-3VGF-8M4Q-Q4QR vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	5 Oct 202622:45	–	osv
Patchstack	NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	5 Oct 202622:45	–	patchstack
Positive Technologies	PT-2026-94324	25 Aug 202600:00	–	ptsecurity

Vulners

Node

vm2_project vm2Range3.11.0–3.11.7npm

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92953
vulncheck	www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray
github	www.github.com/advisories/GHSA-5v7w-95g5-pj6q

05 Oct 2026 22:45Current

5.7Medium risk

Vulners AI Score5.7

CVSS 49.3

CVSS 3.110

EPSS0.00501

SSVC