GHSA-x5qg-8pq6-39h6

Source

https://github.com/advisories/GHSA-x5qg-8pq6-39h6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-x5qg-8pq6-39h6/GHSA-x5qg-8pq6-39h6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-x5qg-8pq6-39h6

Withdrawn

2026-10-05T22:34:30Z

Published

2026-09-17T15:32:15Z

Modified

2026-10-05T22:45:05Z

Severity

10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L CVSS Calculator
10.0 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

Duplicate Advisory: Sandboxed code can read and write host-realm memory via Node's shared Buffer pool

Details

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-fcqc-726x-5wfc This link is maintained to preserve external references.

Original Description

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.

Database specific

{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-05T22:34:30Z",
    "nvd_published_at":  "2026-09-17T14:18:00Z",
    "severity":  "CRITICAL"
}

References

Affected packages

npm / vm2

Package

Name: vm2; View open source insights on deps.dev
Purl: pkg:npm/vm2

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Last Affected

3.11.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-x5qg-8pq6-39h6/GHSA-x5qg-8pq6-39h6.json"