Skip to content
Threat Feed
Subscribe

Product

Vm2 (<= 3.12.1)

1 brief RSS
critical advisory

Critical Sandbox Escape in vm2 via Node.js Buffer Pool

A vulnerability in the vm2 library (CVE-2026-92947) allows sandboxed code to bypass security boundaries by reading and writing to the host-realm memory shared through Node.js Buffer pools.

vm2 +1 sandbox-escape nodejs vulnerability privilege-escalation denial-of-service sandbox javascript cve-2026-100722
2t 1c