Detect vm2 TypedArray/ArrayBuffer Intrinsic Mutation Sandbox Escape (CVE-2026-92953) in Sumo Logic CSE
Detects usage and exploitation risk of vm2 versions 3.11.0 through 3.11.7, which contain an incomplete fix for host-prototype pollution. The default VM allows sandboxed code to mutate host TypedArray and ArrayBuffer intrinsics, enabling prototype pollution that can lead to sandbox escape and arbitrary code execution on the host (CVSS 10.0). This detection surfaces vulnerable vm2 installs via package manifests and SCA telemetry, and identifies runtime behavior consistent with intrinsic mutation attempts within Node.js processes that embed vm2.
MITRE ATT&CK
- Tactic
- Initial Access Execution
Sumo Detection Query
_sourceCategory=*endpoint* OR _sourceCategory=*sca*
| where (process_name matches "*node*" and (command_line matches "*vm2*" or command_line matches "*TypedArray*" or command_line matches "*ArrayBuffer*" or command_line matches "*__proto__*")) or (package_name = "vm2")
| if (package_name = "vm2", package_version, "") as ver
| where ver matches "3.11.[0-7]" or isBlank(ver)
| count by host, process_name, command_line, package_versionSurfaces vulnerable vm2 package versions and Node.js runtime references to intrinsic mutation primitives across endpoint and SCA source categories.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate TypedArray/ArrayBuffer use in production Node services.
- Transient vm2 presence during dependency upgrades.
- Inventory tools enumerating package metadata.
Other platforms for CVE-2026-92953
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Install vulnerable vm2 version
Expected signal: npm install process events and a package.json/package-lock.json referencing [email protected]; SCA inventory records vm2 3.11.7.
- Test 2Node process evaluating TypedArray intrinsic access
Expected signal: Node.js process launch with command line referencing TypedArray/__proto__ intrinsic access.
- Test 3Simulated sandbox escape child-process spawn
Expected signal: Node.js parent process spawning a shell/id child process and writing /tmp/vm2-escape-proof.
References (6)
- https://github.com/patriksimek/vm2/security/advisories/GHSA-3vgf-8m4q-q4qr
- https://nvd.nist.gov/vuln/detail/CVE-2026-92953
- https://github.com/patriksimek/vm2/commit/92a10fca7b3ca63bb1574b6795540264f6805b30
- https://github.com/patriksimek/vm2/releases/tag/v3.11.8
- https://www.vulncheck.com/advisories/vm2-3.11.0-through-3.11.7-prototype-pollution-via-typedarray
- https://github.com/advisories/GHSA-3vgf-8m4q-q4qr
Response Playbook
Triage
- Confirm the affected host runs vm2 at a version in the range 3.11.0–3.11.7 by inspecting package.json/package-lock.json or `npm ls vm2` output; versions >= 3.11.8 are not affected.
- Determine whether the vm2 instance is exposed to attacker-controlled or untrusted script input (e.g., user-submitted code, plugins, template evaluation). Internal-only, trusted-input usage lowers immediate risk but still requires patching.
- Review recent Node.js process telemetry for the host for command-line or child-process activity referencing TypedArray/ArrayBuffer manipulation, unexpected shell spawns from the Node process, or outbound connections initiated post-evaluation.
- Correlate the detection timeframe with any sandbox evaluation endpoints or job queues that accept external code to scope potential exploitation.
Containment
- Upgrade vm2 to 3.11.8 or later across all affected hosts; if immediate upgrade is not possible, disable or gate the feature that evaluates untrusted code through vm2.
- Isolate hosts showing evidence of sandbox escape (unexpected child processes spawned by Node, new persistence, or outbound C2) from the network pending investigation.
- Rotate any secrets, tokens, or credentials accessible to the Node.js process if host compromise is suspected.
Evidence Collection
- Capture the exact vm2 version and dependency tree (`npm ls vm2`, package-lock.json) and the application code path that invokes the VM.
- Preserve Node.js process logs, stdout/stderr, and any EDR process-tree and network telemetry around the detection window.
- Collect submitted/evaluated script payloads from application logs or job queues for malware/exploit analysis.
Escalation Criteria
- !Escalate to incident response if Node.js processes embedding vm2 spawned unexpected shells, wrote new files outside the sandbox, or made unexpected outbound connections.
- !Escalate if the vulnerable vm2 instance is confirmed to evaluate externally controlled code reachable from the internet, given the CVSS 10.0 host-takeover impact.
Investigation Guide
Related Techniques
Forensic Artifacts
- >
package.json / package-lock.json / yarn.lock entries pinning vm2 to a vulnerable 3.11.x version - >
Node.js process command lines, process-tree children, and crash/error logs referencing TypedArray, ArrayBuffer, or prototype access - >
Application job-queue or request logs containing the submitted script payloads evaluated by vm2
Tuning Guidance
Baseline the Node.js applications in your environment that legitimately use TypedArray/ArrayBuffer to reduce command-line keyword noise, and prioritize alerts from the SCA/inventory queries which deterministically identify vulnerable versions. Suppress runtime keyword matches on known developer or build hosts, and treat unexpected child-process spawns from Node as high-fidelity escape indicators regardless of keyword matches.
Hunting Queries
Hunts for unexpected child processes spawned by Node.js, a strong indicator of a successful vm2 sandbox escape.
DeviceProcessEvents | where InitiatingProcessFileName in~ ("node.exe","node") | where ProcessCommandLine !has "node" | project Timestamp, DeviceName, InitiatingProcessCommandLine, FileName, ProcessCommandLine | order by Timestamp descindex=endpoint sourcetype=*process* parent_process="*node*" NOT process="*node*" | stats count by host, parent_process, process, process_command_lineAtomic Red Team Tests
Installs a vm2 version within the affected range to validate SCA/inventory-based detection.
Command
mkdir -p /tmp/vm2-test && cd /tmp/vm2-test && npm init -y >/dev/null 2>&1 && npm install [email protected] >/dev/null 2>&1 && npm ls vm2Cleanup
rm -rf /tmp/vm2-testExpected Telemetry
npm install process events and a package.json/package-lock.json referencing [email protected]; SCA inventory records vm2 3.11.7.
Expected Detection
spl and sumo_logic inventory queries flag vm2 3.11.7 as vulnerable.
Runs a Node.js script that references TypedArray/ArrayBuffer prototype access to validate runtime keyword detection.
Command
node -e "const vm2=require('/tmp/vm2-test/node_modules/vm2'); const {VM}=vm2; try{new VM().run('Object.getPrototypeOf(Int8Array.prototype.__proto__)')}catch(e){console.log('ran')}"Cleanup
echo 'no cleanup required'Expected Telemetry
Node.js process launch with command line referencing TypedArray/__proto__ intrinsic access.
Expected Detection
kql, elastic_eql, chronicle_yaral, and crowdstrike_cql runtime queries match the node command line.
Simulates the post-exploitation signal of a vm2 escape by having Node spawn an unexpected child process.
Command
node -e "require('child_process').execSync('id > /tmp/vm2-escape-proof')"Cleanup
rm -f /tmp/vm2-escape-proofExpected Telemetry
Node.js parent process spawning a shell/id child process and writing /tmp/vm2-escape-proof.
Expected Detection
Hunting queries for unexpected Node child processes fire on the spawned process.