GHSA-3VGF-8M4Q-Q4QR vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

🗓️ 05 Oct 2026 22:45:22Reported by GoogleType

osv🔗 osv.dev👁 4 Views

vm2 default VM allows sandbox code to mutate host TypedArray and ArrayBuffer intrinsics.

Reporter	Title	Published	Views	Family All 22
BDU FSTEC	The vulnerabilities of the functions Uint8Array.prototype(), TypedArray.prototype(), and ArrayBuffer.prototype() in the NPM package manager vm2 package allow a hacker to execute arbitrary code.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92953	17 Sep 202616:10	–	circl
CVE	CVE-2026-92953	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81602	5 Oct 202622:45	–	euvd
Github Security Blog	vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	5 Oct 202622:45	–	github
Github Security Blog	Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	17 Sep 202615:32	–	github
NVD	CVE-2026-92953	17 Sep 202614:18	–	nvd
OSV	CLSA-2026-1791279062 TuxCare security update for vm2 (8 CVEs)	6 Oct 202609:31	–	osv
OSV	CLSA-2026-1791282796 TuxCare security update for vm2 (3 CVEs)	6 Oct 202610:33	–	osv

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92953
github	www.github.com/patriksimek/vm2/commit/92a10fca7b3ca63bb1574b6795540264f6805b30
github	www.github.com/patriksimek/vm2
github	www.github.com/patriksimek/vm2/releases/tag/v3.11.8
vulncheck	www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray

05 Oct 2026 23:00Current

8.1High risk

Vulners AI Score8.1

CVSS 49.3

CVSS 3.110

EPSS0.00501

vm2 host-intrinsic prototype pollution TypedArray ArrayBuffer