Critical Sandbox Escape in vm2 via Node.js Buffer Pool

The vm2 library, a popular JavaScript sandbox for Node.js, contains a critical security vulnerability (CVE-2026-92947) that enables sandbox escape. The flaw arises because vm2 exposes the Node.js Buffer object to sandboxed code by default. In Node.js, small Buffer allocations - including Buffer.from, Buffer.concat, and Buffer.allocUnsafe - utilize a shared internal memory pool. Because the sandbox and host share this pool, an attacker capable of executing arbitrary code within the vm2 sandbox can reference the underlying ArrayBuffer used by the host process. This allows the attacker to read host memory, leading to sensitive data disclosure, or write to host memory, potentially corrupting application state and leading to denial-of-service or further privilege escalation. This affects all versions of vm2 up to and including 3.11.6.

Impact

The vulnerability allows for the cross-realm disclosure of sensitive data processed by the host application, such as authentication tokens, user data, or API keys. Furthermore, the ability for an attacker to perform unauthorized writes to the host-realm memory provides a vector for full sandbox escape, as an attacker can manipulate host process objects or execute arbitrary code outside the restricted sandbox environment. This poses a significant risk to any application that uses vm2 to evaluate untrusted user-provided JavaScript code.

Recommendation

• Upgrade the vm2 package to the latest version that addresses CVE-2026-92947, or if no patch is available, migrate to a more secure sandboxing alternative.
• Implement strict input validation and sanitization for all code passed into the vm2 sandbox, though this is not a complete mitigation for the identified memory-sharing flaw.
• Apply the principle of least privilege to the Node.js host process by limiting access to sensitive memory, files, and network resources to reduce the potential impact of a sandbox escape.