AIKIDO-2026-947009

vm2 is vulnerable to Out-of-bounds Write

Out-of-bounds WriteGHSA-489w-w794-jq94 Published 5 days ago

100

Critical Risk

This Affects:

vm2

0.1.0 - 3.12.1

Fixed in 3.12.2

Are you affected? Scan for Free

TL;DR

A host allocated Buffer passed into the sandbox (a builtin return such as zlib.deflateSync, an embedder supplied buffer, or a callback argument) exposes Node's shared 64 KiB pool through .buffer and the legacy .parent accessors. Sandbox code can open a full width view of the backing ArrayBuffer to read past its own data and overwrite unrelated host buffers. The bridge used backing store ownership only for sandbox allocated buffers, not for host views that crossed into the sandbox. The fix limits every host ArrayBufferView at the bridge by identity, returns a bounded copy when a view does not own its whole store, and blocks the raw backing store getters.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and you pass pool backed Buffer values from a host builtin or callback (for example an allowlisted zlib) into sandboxed code.