A flaw was found in vm2. When an application permits the sandbox to access built-in Node.js modules such as the zlib compression library, returned data buffers fail to maintain memory isolation from the host system. An attacker executing untrusted code within the sandbox can inspect and alter the underlying shared memory pool, resulting in sensitive information disclosure and memory corruption across the sandbox boundary.
Last checked: 2026-10-01 20:00 UTC
Proof of concept · CISA Coordinator (Assessed 2026-10-01 18:04 UTC)
Fix evidence last checked: 2026-09-28 17:03 UTC