NPM: vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

🗓️ 05 Oct 2026 22:45:22Reported by PatchstackType

Default VM in npm vm2 can mutate host TypedArray and ArrayBuffer intrinsics.

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerabilities of the functions Uint8Array.prototype(), TypedArray.prototype(), and ArrayBuffer.prototype() in the NPM package manager vm2 package allow a hacker to execute arbitrary code.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92953	17 Sep 202616:10	–	circl
CVE	CVE-2026-92953	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81602	5 Oct 202622:45	–	euvd
Github Security Blog	vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	5 Oct 202622:45	–	github
Github Security Blog	Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	17 Sep 202615:32	–	github
NVD	CVE-2026-92953	17 Sep 202614:18	–	nvd
OSV	GHSA-3VGF-8M4Q-Q4QR vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix	5 Oct 202622:45	–	osv
Positive Technologies	PT-2026-94324	25 Aug 202600:00	–	ptsecurity

Vulners

Node

npm vm2Range≤>= 3.11.0, 3.11.7

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92953
github	www.github.com/patriksimek/vm2/commit/92a10fca7b3ca63bb1574b6795540264f6805b30
github	www.github.com/patriksimek/vm2/releases/tag/v3.11.8
vulncheck	www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray
github	www.github.com/advisories/GHSA-3vgf-8m4q-q4qr

05 Oct 2026 22:45Current

5.9Medium risk

Vulners AI Score5.9

CVSS 49.3

CVSS 3.110

EPSS0.00501

SSVC