EUVD-2026-81602

vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix...

Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3vgf-8m4q-q4qr. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox...

GHSA-5V7W-95G5-PJ6Q Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-3vgf-8m4q-q4qr. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox...

CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arra...

CVE-2026-92953

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arra...

CVE-2026-92953 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arra...

CVE-2026-92953: Improper Control of Dynamically-Managed Code Resources

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arra...

PT-2026-94324

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.0 through 3.11.7 Description The software fails to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can utilize prototype-walking primitives to access and modify Uint8Array.prototype,...