Prototype Pollution Vulnerability in vm2 by Patrik Simek

CVE-2026-92953

What is CVE-2026-92953?

The vm2 library versions prior to 3.11.8 are susceptible to a prototype pollution vulnerability. This occurs due to insufficient restrictions on host TypedArray and ArrayBuffer prototypes, allowing attackers to perform prototype-walking exploits. As a result, entities like Uint8Array.prototype and ArrayBuffer.prototype could be compromised, potentially enabling modified behaviour in host-created typed arrays that return attacker-controlled properties once VM.run() concludes. This poses significant risks to applications that rely on secure sandboxing.

References