Detect vm2 TypedArray/ArrayBuffer Intrinsic Mutation Sandbox Escape (CVE-2026-92953) in Splunk
Detects usage and exploitation risk of vm2 versions 3.11.0 through 3.11.7, which contain an incomplete fix for host-prototype pollution. The default VM allows sandboxed code to mutate host TypedArray and ArrayBuffer intrinsics, enabling prototype pollution that can lead to sandbox escape and arbitrary code execution on the host (CVSS 10.0). This detection surfaces vulnerable vm2 installs via package manifests and SCA telemetry, and identifies runtime behavior consistent with intrinsic mutation attempts within Node.js processes that embed vm2.
MITRE ATT&CK
- Tactic
- Initial Access Execution
SPL Detection Query
index=sca OR index=osquery sourcetype IN ("osquery:npm_packages","sca:dependencies")
| search package="vm2"
| rex field=version "^(?<maj>\d+)\.(?<min>\d+)\.(?<pat>\d+)"
| eval vuln=if(maj==3 AND min==11 AND pat>=0 AND pat<=7, 1, 0)
| where vuln=1
| stats values(version) as versions values(path) as install_paths by host package
| eval cve="CVE-2026-92953", fixed_version="3.11.8"
| table host package versions install_paths cve fixed_versionFinds vulnerable vm2 installs (3.11.0–3.11.7) across hosts using osquery npm_packages or SCA dependency inventory sourcetypes.
Data Sources
Required Sourcetypes
False Positives & Tuning
- Developer or build hosts with vm2 installed in isolated node_modules not reachable by untrusted input.
- Inventory snapshots captured before a scheduled upgrade to 3.11.8 completes.
- Nested transitive vm2 copies pinned by a tool that is not exposed to attacker-controlled scripts.
Other platforms for CVE-2026-92953
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Install vulnerable vm2 version
Expected signal: npm install process events and a package.json/package-lock.json referencing [email protected]; SCA inventory records vm2 3.11.7.
- Test 2Node process evaluating TypedArray intrinsic access
Expected signal: Node.js process launch with command line referencing TypedArray/__proto__ intrinsic access.
- Test 3Simulated sandbox escape child-process spawn
Expected signal: Node.js parent process spawning a shell/id child process and writing /tmp/vm2-escape-proof.
References (6)
- https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr
- https://nvd.nist.gov/vuln/detail/CVE-2026-92953
- https://github.com/patriksimek/vm2/commit/92a10fca7b3ca63bb1574b6795540264f6805b30
- https://github.com/patriksimek/vm2/releases/tag/v3.11.8
- https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray
- https://github.com/advisories/GHSA-3vgf-8m4q-q4qr
Response Playbook
Triage
- Confirm the affected host runs vm2 at a version in the range 3.11.0–3.11.7 by inspecting package.json/package-lock.json or `npm ls vm2` output; versions >= 3.11.8 are not affected.
- Determine whether the vm2 instance is exposed to attacker-controlled or untrusted script input (e.g., user-submitted code, plugins, template evaluation). Internal-only, trusted-input usage lowers immediate risk but still requires patching.
- Review recent Node.js process telemetry for the host for command-line or child-process activity referencing TypedArray/ArrayBuffer manipulation, unexpected shell spawns from the Node process, or outbound connections initiated post-evaluation.
- Correlate the detection timeframe with any sandbox evaluation endpoints or job queues that accept external code to scope potential exploitation.
Containment
- Upgrade vm2 to 3.11.8 or later across all affected hosts; if immediate upgrade is not possible, disable or gate the feature that evaluates untrusted code through vm2.
- Isolate hosts showing evidence of sandbox escape (unexpected child processes spawned by Node, new persistence, or outbound C2) from the network pending investigation.
- Rotate any secrets, tokens, or credentials accessible to the Node.js process if host compromise is suspected.
Evidence Collection
- Capture the exact vm2 version and dependency tree (`npm ls vm2`, package-lock.json) and the application code path that invokes the VM.
- Preserve Node.js process logs, stdout/stderr, and any EDR process-tree and network telemetry around the detection window.
- Collect submitted/evaluated script payloads from application logs or job queues for malware/exploit analysis.
Escalation Criteria
- !Escalate to incident response if Node.js processes embedding vm2 spawned unexpected shells, wrote new files outside the sandbox, or made unexpected outbound connections.
- !Escalate if the vulnerable vm2 instance is confirmed to evaluate externally controlled code reachable from the internet, given the CVSS 10.0 host-takeover impact.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
package.json / package-lock.json / yarn.lock entries pinning vm2 to a vulnerable 3.11.x version - >
Node.js process command lines, process-tree children, and crash/error logs referencing TypedArray, ArrayBuffer, or prototype access - >
Application job-queue or request logs containing the submitted script payloads evaluated by vm2
Tuning Guidance
Baseline the Node.js applications in your environment that legitimately use TypedArray/ArrayBuffer to reduce command-line keyword noise, and prioritize alerts from the SCA/inventory queries which deterministically identify vulnerable versions. Suppress runtime keyword matches on known developer or build hosts, and treat unexpected child-process spawns from Node as high-fidelity escape indicators regardless of keyword matches.
Hunting Queries
Hunts for unexpected child processes spawned by Node.js, a strong indicator of a successful vm2 sandbox escape.
DeviceProcessEvents | where InitiatingProcessFileName in~ ("node.exe","node") | where ProcessCommandLine !has "node" | project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine | order by Timestamp descindex=endpoint sourcetype=*process* parent_process="*node*" NOT process="*node*" | stats count by host, parent_process, process, process_command_lineAtomic Red Team Tests
Installs a vm2 version within the affected range to validate SCA/inventory-based detection.
Command
mkdir -p /tmp/vm2-test && cd /tmp/vm2-test && npm init -y >/dev/null 2>&1 && npm install [email protected] >/dev/null 2>&1 && npm ls vm2Cleanup
rm -rf /tmp/vm2-testExpected Telemetry
npm install process events and a package.json/package-lock.json referencing [email protected]; SCA inventory records vm2 3.11.7.
Expected Detection
spl and sumo_logic inventory queries flag vm2 3.11.7 as vulnerable.
Runs a Node.js script that references TypedArray/ArrayBuffer prototype access to validate runtime keyword detection.
Command
node -e "const vm2=require('/tmp/vm2-test/node_modules/vm2'); const {VM}=vm2; try{new VM().run('Object.getPrototypeOf(Int8Array.prototype.__proto__)')}catch(e){console.log('ran')}"Cleanup
echo 'no cleanup required'Expected Telemetry
Node.js process launch with command line referencing TypedArray/__proto__ intrinsic access.
Expected Detection
kql, elastic_eql, chronicle_yaral, and crowdstrike_cql runtime queries match the node command line.
Simulates the post-exploitation signal of a vm2 escape by having Node spawn an unexpected child process.
Command
node -e "require('child_process').execSync('id > /tmp/vm2-escape-proof')"Cleanup
rm -f /tmp/vm2-escape-proofExpected Telemetry
Node.js parent process spawning a shell/id child process and writing /tmp/vm2-escape-proof.
Expected Detection
Hunting queries for unexpected Node child processes fire on the spawned process.