CVE-2026-92953: Patriksimek VM2

Critical severity, CVSS 10.0. EPSS: 0.5% chance of exploitation in the next 30 days.

vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use prototype-walking primitives to reach and modify host Uint8Array.prototype, %TypedArray%.prototype, and ArrayBuffer.prototype, causing host-created typed arrays to observe attacker-controlled properties after VM.run() returns.

Affected products

• Patriksimek VM2: from 3.11.0, before 3.11.8 (fixed in 3.11.8)

Published 2026-09-17. Last modified 2026-09-18.