Secuno
ENNL
Book demo

CVE-2026-92953

10.0 CRITICAL
  1. Published17 Sept 2026

Description

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityNone
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-9295510.0
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows…
CVE-2026-9294610.0
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external…
CVE-2026-929359.0
vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <=…
CVE-2026-651818.1
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with…
CVE-2026-418708.8
Missing Authorization, Improper Control of Generation of Code ('Code Injection'),…
CVE-2026-592839.1
Applications that evaluate Spring Expression Language (SpEL) expressions using…

Frequently asked

Is CVE-2026-92953 being actively exploited?

CVE-2026-92953 is not in the CISA KEV catalog.

How severe is CVE-2026-92953?

CVE-2026-92953 has a CVSS 3.1 base score of 10.0, rated critical.

How do I fix CVE-2026-92953?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-92953 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.