CVSS 4.0
9.3 criticalCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:HCVE-2026-92953
Critical (9.3). EPSS 0.5% chance of exploitation in the next 30 days. Fixed in vm2 3.11.8.
vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.
Severity
CVSS 3.1
10.0 criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 42% of CVEs (scores of 2026-10-31)
- CWE
- CWE-913
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-3vgf-8m4q-q4qr | npm | vm2 | >=3.11.0 <3.11.8 | 3.11.8 |