{"id":"EUVD-2026-81602","revision":null,"records":[{"revision":"8334a8b53d5a4f44a9ef6596961e851f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92953","aliases":[],"title":"vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray","description":"vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.","state":0,"publishedAt":"2026-09-17T13:46:12.146+00:00","modifiedAt":"2026-09-18T19:49:31.925+00:00","affected":[{"ecosystem":"Vendor product","name":"vm2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"patriksimek\",\n                    \"product\": \"vm2\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/vm2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.11.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.11.8\"\n                        },\n                        {\n                            \"version\": \"3.11.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","score":10,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr","https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92953","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92953","identifiers":["CVE-2026-92953"]},"retained":false,"historicalAffected":[]},{"revision":"e1123cbf530544ddada3a4c1a899313c","observedAt":"2026-11-11T17:05:18.045+00:00","statement":{"source":"euvd","id":"EUVD-2026-81602","aliases":["CVE-2026-92953","GHSA-5v7w-95g5-pj6q","GHSA-3vgf-8m4q-q4qr"],"title":"vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, a…","description":"vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","score":9.3,"severity":null}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr","https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81602","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 17, 2026, 1:46:12 PM","dateUpdated":"Sep 18, 2026, 7:49:31 PM"},"relatedAdvisories":[{"id":"RHSA-2026:82151","title":"Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-54284","CVE-2026-55553","CVE-2026-59893","CVE-2026-71491","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-88932","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:79088","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-14456","CVE-2026-18798","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-63072","CVE-2026-63076","CVE-2026-67213","CVE-2026-67214","CVE-2026-67422","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84445","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"WID-SEC-W-2026-3071","title":"vm2: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-92933","CVE-2026-92934","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92959","CVE-2026-92936"]},{"id":"RHSA-2026:80603","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-47686","CVE-2026-47698","CVE-2026-84961","CVE-2026-85152","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92956","CVE-2026-92957","CVE-2026-92960","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606","CVE-2026-101916"]},{"id":"RHSA-2026:91651","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.10 release.","vulnerabilityIds":["CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-84445","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606","CVE-2026-111943"]},{"id":"RHSA-2026:80644","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-47686","CVE-2026-47698","CVE-2026-84961","CVE-2026-85152","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92956","CVE-2026-92957","CVE-2026-92960","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606","CVE-2026-101916"]},{"id":"RHSA-2026:76788","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-77413","CVE-2026-77414","CVE-2026-77415","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-81602","identifiers":["EUVD-2026-81602","CVE-2026-92953","GHSA-5v7w-95g5-pj6q","GHSA-3vgf-8m4q-q4qr"]},"retained":false,"historicalAffected":[]},{"revision":"0e8e80ae73b041e4ac71a222fe5aefac","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-92953","aliases":[],"title":"vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, a…","description":"vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.","state":0,"publishedAt":"2026-09-17T14:18:01.16+00:00","modifiedAt":"2026-09-18T20:17:31.113+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","score":10,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr","https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92953","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-913"],"productCriteria":[],"sourceDates":{"published":"2026-09-17T14:18:01.160","lastModified":"2026-09-18T20:17:31.113"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-92953","identifiers":["CVE-2026-92953"]},"retained":false,"historicalAffected":[]},{"revision":"42b5a62ac2124ea1b887d3163ddb572f","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-3vgf-8m4q-q4qr","aliases":["CVE-2026-92953"],"title":"vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix","description":"## Summary\n\nvm2's current host-intrinsic prototype protection is incomplete. The fix for `GHSA-vwrp-x96c-mhwq` blocks sandbox writes into classic host intrinsics such as `Object.prototype`, `Array.prototype`, and `Function.prototype`, but current head still lets sandbox code in a default `VM` reach and mutate host `Uint8Array.prototype`, `%TypedArray%.prototype`, and `ArrayBuffer.prototype`.\n\nAfter `VM.run()` returns, normal host typed-array and ArrayBuffer objects observe attacker-controlled properties and methods installed by the sandbox.\n\n## Technical Details\n\nThe existing mitigation relies on `protectedHostObjects` in `lib/bridge.js`. That set is populated from `otherGlobalPrototypes`, which is built from a fixed inventory of classic globals:\n\n```js\nconst globalsList = [\n  'Number', 'String', 'Boolean', 'Date', 'RegExp', 'Map', 'WeakMap',\n  'Set', 'WeakSet', 'Promise', 'Function'\n];\n```\n\nThe inventory omits typed-array and ArrayBuffer intrinsics. Sandbox code can still reuse the host-prototype walking primitive from the prior public advisory:\n\n```js\nconst lookupGetter = ({}).__lookupGetter__;\nconst apply = Buffer.apply;\nconst protoGetter = apply.apply(lookupGetter, [Buffer, ['__proto__']]);\nconst hostBuffer = Buffer.from([1]);\n\nconst hostBufferPrototype = protoGetter.call(hostBuffer);\nconst hostUint8ArrayPrototype = protoGetter.call(hostBufferPrototype);\nconst hostTypedArrayPrototype = protoGetter.call(hostUint8ArrayPrototype);\nconst hostArrayBufferPrototype = protoGetter.call(hostBuffer.buffer);\n```\n\nThose objects are not sandbox-local. Inside the sandbox, `hostUint8ArrayPrototype === Uint8Array.prototype`, `hostTypedArrayPrototype === Object.getPrototypeOf(Uint8Array.prototype)`, and `hostArrayBufferPrototype === ArrayBuffer.prototype` are all false. Because the objects are not in `protectedHostObjects`, bridge `defineProperty` writes are forwarded into the real host objects.\n\nThis is the same guard-coverage boundary as the previous host-intrinsic prototype pollution fix, but with a missing intrinsic family. The bridge already has the correct enforcement shape; the protected inventory is too narrow.\n\n## PoC\n\nPoV: `poc/pov-host-typedarray-arraybuffer-prototype-pollution.js`\n\nCurrent-head output:\n\n```json\n{\n  \"status\": \"completed\",\n  \"vulnerable\": true,\n  \"node\": \"v25.8.0\",\n  \"v8\": \"14.1.146.11-node.20\",\n  \"control\": {\n    \"defineResult\": true,\n    \"sandboxReadsBack\": \"sandbox-only\",\n    \"hostControlAfter\": null\n  },\n  \"exploit\": {\n    \"hostUint8IsSandboxUint8\": false,\n    \"hostTypedArrayIsSandboxTypedArray\": false,\n    \"hostArrayBufferIsSandboxArrayBuffer\": false,\n    \"defineUint8\": true,\n    \"defineTypedArray\": true,\n    \"defineArrayBuffer\": true,\n    \"defineMethod\": true\n  },\n  \"hostEffect\": {\n    \"uint8Marker\": \"polluted-host-uint8array-prototype\",\n    \"typedArrayMarker\": \"polluted-host-typedarray-prototype\",\n    \"arrayBufferMarker\": \"polluted-host-arraybuffer-prototype\",\n    \"methodReturn\": \"sandbox-method-reached-host-uint8array\"\n  }\n}\n```\n\nThe control proves sandbox-local `Uint8Array.prototype` writes remain sandbox-local. The exploit path reaches host prototypes through the bridge and causes host-created objects to observe sandbox-installed properties after `VM.run()` returns.\n\n## Impact\n\nThis is a sandbox boundary violation and host intrinsic prototype pollution. An attacker who can run JavaScript in a default vm2 `VM` can mutate shared host typed-array and ArrayBuffer behavior without `NodeVM`, `require`, wildcard builtins, `nesting: true`, or any host-provided typed-array object.\n\nThe supplied PoV demonstrates integrity and availability impact by installing markers and a method on host prototypes:\n\n- `Uint8Array.prototype`\n- `%TypedArray%.prototype`, which affects typed-array families through the shared typed-array prototype chain\n- `ArrayBuffer.prototype`\n\nThe PoV does not claim direct host command execution or direct confidentiality impact. It is local-only and restores touched descriptors before exit.\n\n## Suggested Fix\n\nExtend the protected host-object inventory and identity/prototype mappings to typed-array and binary-data intrinsics, including at least:\n\n- `%TypedArray%.prototype`\n- `ArrayBuffer.prototype`\n- `SharedArrayBuffer.prototype` when present\n- `DataView.prototype`\n- all concrete typed-array prototypes present in the runtime, including `Uint8Array.prototype`, `Uint8ClampedArray.prototype`, `Int8Array.prototype`, `Uint16Array.prototype`, `Int16Array.prototype`, `Uint32Array.prototype`, `Int32Array.prototype`, `Float16Array.prototype` when present, `Float32Array.prototype`, `Float64Array.prototype`, `BigInt64Array.prototype`, and `BigUint64Array.prototype`\n\nA temporary patched-control that added this intrinsic family to `thisGlobalPrototypes` caused the same PoV's `Reflect.defineProperty()` calls to throw `VMError: Operation not allowed on contextified object`, and no host markers were installed.\n\nThe fix should cover the same host mutation traps used by the existing host-intrinsic protection: `set`, `defineProperty`, `deleteProperty`, and `preventExtensions`. It should not special-case `Buffer`; `Buffer` is only one way to reach the omitted host prototypes.\n\n## Affected Package/Versions\n\nConfirmed on current head `7a1f5100b96f48d34e0fe104ab37c0acc5944f92` / `v3.11.5` with Node `v25.8.0` / V8 `14.1.146.11-node.20`.\n\nConfirmed affected after the prior patch: `npm:vm2 >= 3.11.0, <= 3.11.5`.\n\nLocal sweep also reproduces on `v3.10.0` through `v3.10.5`, but that range overlaps the already-published `GHSA-vwrp-x96c-mhwq` range. `v3.9.0` through `v3.9.2` did not produce host-visible pollution in the same local test.\n\n## Why This Is Not Intended Behavior\n\nvm2 documents `VM` as a sandbox for untrusted code without `require`, with only JavaScript built-ins and Node's `Buffer` available by default. The known escape hatches do not explain this issue:\n\n- `require.builtin: ['*']` is a `NodeVM` configuration; this PoV uses default `VM`.\n- `nesting: true` is not enabled or used.\n- The README timeout caveat covers host code operating on objects returned from the sandbox; this PoV mutates host intrinsics and later affects ordinary host-created typed arrays and ArrayBuffers.\n\nThe project's own attack notes state that host-realm intrinsic prototypes should be protected from sandbox writes, while non-intrinsic host objects may remain mutable when intentionally exposed. Typed-array and ArrayBuffer prototypes are host intrinsics, not embedder-owned application objects.\n\n`Buffer` availability explains how the PoV reaches the host prototype chain, but it does not authorize mutation of unrelated host-realm intrinsics. The host effects are observed on new host-created typed arrays and ArrayBuffers after `VM.run()` returns; the host is not invoking an object returned from the sandbox.","state":0,"publishedAt":"2026-10-05T22:45:22+00:00","modifiedAt":"2026-10-05T23:00:06.3098657+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.11.0"},{"kind":"fixed","version":"3.11.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr","https://nvd.nist.gov/vuln/detail/CVE-2026-92953","https://github.com/patriksimek/vm2/commit/92a10fca7b3ca63bb1574b6795540264f6805b30","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.11.8","https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray"],"sourceUrl":"https://github.com/advisories/GHSA-3vgf-8m4q-q4qr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-3vgf-8m4q-q4qr","identifiers":["GHSA-3vgf-8m4q-q4qr","CVE-2026-92953"]},"retained":false,"historicalAffected":[]},{"revision":"4ac91d96320840cbb2e1ed1fd6a69688","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-5v7w-95g5-pj6q","aliases":[],"title":"Duplicate Advisory: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fix","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-3vgf-8m4q-q4qr. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.","state":2,"publishedAt":"2026-09-17T15:32:16+00:00","modifiedAt":"2026-10-05T23:00:04.2479842+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.11.0"},{"kind":"last_affected","version":"3.11.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr","https://nvd.nist.gov/vuln/detail/CVE-2026-92953","https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray"],"sourceUrl":"https://github.com/advisories/GHSA-5v7w-95g5-pj6q","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-5v7w-95g5-pj6q","identifiers":["GHSA-5v7w-95g5-pj6q"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T20:58:42.4460032+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T20:58:42.4460032+00:00","lastSuccessAt":"2026-11-11T20:58:42.6009016+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.6009024+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-bc2564cf749a574ebe6216cd53b2772c98ccf01e107d9e465c7cb9637c59db40","complete":true,"records":424281,"lastAttemptAt":"2026-11-11T20:56:40.1262638+00:00","lastSuccessAt":"2026-11-11T19:56:47.8167322+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:56:40.1262638+00:00","snapshotPublishedAt":"2026-11-11T19:18:45+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cbeeeca22e4a4c188e95cc4f8cfc6560","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T21:08:58.0161049+00:00","lastSuccessAt":"2026-11-11T21:08:58.011+00:00","error":"249 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-11T21:08:58.011+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13368,"expectedIdentifiers":13813,"failedIdentifiers":249},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T20:58:42.4460032+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T20:58:42.4460032+00:00","lastSuccessAt":"2026-11-11T20:58:42.6018487+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.6018491+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f58072f00ed84b8dbc554f4a4e66e21a","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T20:59:01.4643428+00:00","lastSuccessAt":"2026-11-11T20:59:01.459+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:59:01.459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T20:58:42.3041045+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.3041045+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T20:56:40.2809572+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:56:40.2809572+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T20:58:42.411286+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.411286+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-757d3692f9a7b34792dad960197f3cc953a54db59b7d0ffe3835a0ed9926f76b","complete":true,"records":231690,"lastAttemptAt":"2026-11-11T20:58:42.1683586+00:00","lastSuccessAt":"2026-11-11T20:58:40.6131056+00:00","error":null,"lastVerifiedAt":"2026-11-11T20:58:42.1683586+00:00","snapshotPublishedAt":"2026-11-11T20:03:03+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}