Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

🗓️ 17 Sep 2026 15:32:15Reported by GitHub Advisory DatabaseType

vm2 exposes Node's shared Buffer pool to sandboxed code allowing host memory disclosure.

Reporter	Title	Published	Views	Family All 13
BDU FSTEC	The vulnerabilities of the `Buffer.from()` and `Buffer.concat()` functions in the `vm2` library from the NPM package manager allow a malicious actor to gain unauthorized access to protected information and cause service failures.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92947	17 Sep 202616:09	–	circl
CVE	CVE-2026-92947	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92947 vm2 before 3.11.7 Memory Disclosure via Buffer Pool	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81596	5 Oct 202622:34	–	euvd
Github Security Blog	vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool	5 Oct 202622:34	–	github
NVD	CVE-2026-92947	17 Sep 202614:18	–	nvd
Patchstack	NPM: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool	5 Oct 202622:34	–	patchstack
Positive Technologies	PT-2026-94318	25 Aug 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-92947: Exposure of Sensitive Information to an Unauthorized Actor	17 Sep 202600:00	–	rapid7

Vulners

Node

vm2_project vm2Range≤3.11.6npm

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-fcqc-726x-5wfc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92947
vulncheck	www.vulncheck.com/advisories/vm2-before-3.11.7-memory-disclosure-via-buffer-pool
github	www.github.com/advisories/GHSA-x5qg-8pq6-39h6

05 Oct 2026 22:34Current

5.8Medium risk

Vulners AI Score5.8

CVSS 410

CVSS 3.110

EPSS0.00482

SSVC