6.9
Moyenne
CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength…
Description
vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist (require: { builtin: ['zlib'] }), zlib.deflateSync can return a Buffer backed by Node's shared small-buffer pool whose .buffer is the entire pool. Untrusted guest code can construct a full-width view of that ArrayBuffer (Buffer.from(result.buffer, 0, result.buffer.byteLength)) to read and modify bytes belonging to unrelated host buffers, disclosing and corrupting host-realm memory across the sandbox boundary.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| vm2 3.12 | premières → < 3.12.2 | 3.12.2 |
Références
- GitHub Security Advisory (GHSA-489w-w794-jq94) github.com
- Patch Commit github.com
- Patch Commit github.com
- VulnCheck Advisory: vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool www.vulncheck.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de vm2
Les 77 CVE de vm2 →
CVE-2026-100722
vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap
8.9
Élevée
CVE-2026-100721
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver
9.5
Critique
CVE-2026-93606
vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`
10.0
Critique
CVE-2026-93605
vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits…
10.0
Critique