Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the incomplete protection of host-intrinsic prototypes in vm2. The createBridge function in lib/bridge.js is responsible for creating the sandboxed environment and setting up protections for host objects. The vulnerability stems from an incomplete globalsList constant, which createBridge uses to identify and protect global host objects. The list was missing TypedArray and ArrayBuffer intrinsics. This allowed an attacker to get a reference to these unprotected host objects and modify their prototypes, leading to prototype pollution. The provided patch addresses this by extending the globalsList to include the missing intrinsics and adding logic to createBridge to handle them. Therefore, the createBridge function is identified as the vulnerable function as it contained the flawed logic that failed to protect all host-intrinsic prototypes.
createBridgelib/bridge.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vm2 | npm | >= 3.11.0, <= 3.11.7 | 3.11.8 |
definePropertyThis is the same guard-coverage boundary as the previous host-intrinsic prototype pollution fix, but with a missing intrinsic family. The bridge already has the correct enforcement shape; the protected inventory is too narrow.
PoV: poc/pov-host-typedarray-arraybuffer-prototype-pollution.js
Current-head output:
{
"status": "completed",
"vulnerable": true,
"node": "v25.8.0",
"v8": "14.1.146.11-node.20",
"control": {
"defineResult": true,
"sandboxReadsBack": "sandbox-only",
"hostControlAfter": null
},
"exploit": {
"hostUint8IsSandboxUint8": false,
"hostTypedArrayIsSandboxTypedArray": false,
"hostArrayBufferIsSandboxArrayBuffer": false,
"defineUint8": true,
"defineTypedArray": true,
"defineArrayBuffer": true,
"defineMethod": true
},
"hostEffect": {
"uint8Marker": "polluted-host-uint8array-prototype",
"typedArrayMarker": "polluted-host-typedarray-prototype",
"arrayBufferMarker": "polluted-host-arraybuffer-prototype",
"methodReturn": "sandbox-method-reached-host-uint8array"
}
}
The control proves sandbox-local Uint8Array.prototype writes remain sandbox-local. The exploit path reaches host prototypes through the bridge and causes host-created objects to observe sandbox-installed properties after VM.run() returns.
This is a sandbox boundary violation and host intrinsic prototype pollution. An attacker who can run JavaScript in a default vm2 VM can mutate shared host typed-array and ArrayBuffer behavior without NodeVM, require, wildcard builtins, nesting: true, or any host-provided typed-array object.
The supplied PoV demonstrates integrity and availability impact by installing markers and a method on host prototypes:
Uint8Array.prototype%TypedArray%.prototype, which affects typed-array families through the shared typed-array prototype chainArrayBuffer.prototypeThe PoV does not claim direct host command execution or direct confidentiality impact. It is local-only and restores touched descriptors before exit.
Extend the protected host-object inventory and identity/prototype mappings to typed-array and binary-data intrinsics, including at least:
%TypedArray%.prototypeArrayBuffer.prototypeSharedArrayBuffer.prototype when presentDataView.prototypeUint8Array.prototype, Uint8ClampedArray.prototype, Int8Array.prototype, Uint16Array.prototype, Int16Array.prototype, Uint32Array.prototype, Int32Array.prototype, Float16Array.prototype when present, Float32Array.prototype, Float64Array.prototype, BigInt64Array.prototype, and BigUint64Array.prototypeA temporary patched-control that added this intrinsic family to thisGlobalPrototypes caused the same PoV's Reflect.defineProperty() calls to throw VMError: Operation not allowed on contextified object, and no host markers were installed.
The fix should cover the same host mutation traps used by the existing host-intrinsic protection: set, defineProperty, deleteProperty, and preventExtensions. It should not special-case Buffer; Buffer is only one way to reach the omitted host prototypes.
Confirmed on current head 7a1f5100b96f48d34e0fe104ab37c0acc5944f92 / v3.11.5 with Node v25.8.0 / V8 14.1.146.11-node.20.
Confirmed affected after the prior patch: npm:vm2 >= 3.11.0, <= 3.11.5.
Local sweep also reproduces on v3.10.0 through v3.10.5, but that range overlaps the already-published GHSA-vwrp-x96c-mhwq range. v3.9.0 through v3.9.2 did not produce host-visible pollution in the same local test.
vm2 documents VM as a sandbox for untrusted code without require, with only JavaScript built-ins and Node's Buffer available by default. The known escape hatches do not explain this issue:
require.builtin: ['*'] is a NodeVM configuration; this PoV uses default VM.nesting: true is not enabled or used.The project's own attack notes state that host-realm intrinsic prototypes should be protected from sandbox writes, while non-intrinsic host objects may remain mutable when intentionally exposed. Typed-array and ArrayBuffer prototypes are host intrinsics, not embedder-owned application objects.
Buffer availability explains how the PoV reaches the host prototype chain, but it does not authorize mutation of unrelated host-realm intrinsics. The host effects are observed on new host-created typed arrays and ArrayBuffers after VM.run() returns; the host is not invoking an object returned from the sandbox.