CVE-2026-92947: vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

vm2 exposes Buffer to sandboxed code by default. Node serves small allocations from one shared 64 KB pool: Buffer.allocUnsafe(), Buffer.from(array), Buffer.from(string) and Buffer.concat(). The sandbox and the host both draw from that pool. Sandboxed code can take the pool's underlying ArrayBuffer and view the whole thing.

That means the sandbox sees bytes that neighbouring host buffers hold. Those can be secrets, tokens or request data that the host handled with the functions above. The sandbox can also write to the pool, which changes host buffers in place. The advisory mentions sensitive data exposure and possible denial of service.

The attacker needs only the ability to submit code to a vm2 sandbox. No privileges or user interaction are needed, which is why the vector is network-based with a changed scope. Services that run user scripts, plugins or templates in vm2 are the exposed ones.

All vm2 releases up to and including 3.11.6 are affected, in the default configuration where Buffer is exposed to the sandbox. The proof of concept was tested on 3.11.5. Check your installed version:

npm ls vm2

Check transitive dependencies too, since many tools bundle vm2.

Upgrade to vm2 3.11.7.

npm install [email protected]

The advisory and release notes list no workaround. Treat any secret that passed through small Buffer operations in a process running untrusted vm2 code as possibly exposed, and rotate it.

The attack leaves no log line. Review the sandboxed code you ran for use of .buffer on a Buffer, followed by Buffer.from(x.buffer, 0, x.buffer.byteLength) or typed-array reads over the whole pool. The proof of concept is Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString('ascii'). Search stored user scripts for that pattern. Audit lockfiles for vm2 at 3.11.6 or lower.

Summary

Sandboxed code is able to disclose host memory used by small allocations by Buffer.from, Buffer.concat.

Details

vm2 exposes Buffer object to sandboxed code by default. Small `Buffer` allocations (for example, Buffer.allocUnsafe(), Buffer.from(array), Buffer.from(string), and Buffer.concat()) use the same Buffer pool, which is shared with the sandbox. This allows sandboxed code to disclose host memory used by the functions listed above.

PoC

Tested against [email protected] in the node REPL.

Buffer.from('host-memory-should-not-leak-to-sandbox')
new (require('vm2').VM)().run(`Buffer.from(Buffer.from([0]).buffer, 0, Buffer.from([0]).buffer.byteLength).toString('ascii')`)

Impact

Since sandbox acquires an ArrayBuffer that is used by the host, it can disclose sensitive data going through functions mentioned above and even write to these buffers, which can lead to sensitive data exposure and potentially denial-of-service.