Memory Disclosure Vulnerability in vm2 by Patrik Simek

CVE-2026-92947

What is CVE-2026-92947?

The vm2 library, prior to version 3.11.7, presents a significant memory disclosure vulnerability that allows sandboxed code to access Node.js's shared Buffer pool. This flaw enables malicious code to read from and write to sensitive host memory, particularly through Buffer operations such as Buffer.from and Buffer.concat. By taking advantage of ArrayBuffers sourced from smaller memory allocations, attackers can gain access to sensitive data, potentially leading to unauthorized data exposure and further denial-of-service conditions.

References