CyberRota Analysis
AI-GeneratedThe vulnerability allows sandboxed code in vm2 versions prior to 3.11.7 to access Node.js's shared Buffer pool, enabling it to read and write to host memory. This could lead to the exposure of sensitive data and potential denial-of-service attacks. Organizations using affected versions of vm2 should prioritize immediate updates to mitigate these critical risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations. Sandboxed code can read and write to host-realm buffers by acquiring ArrayBuffers from small allocations, leading to sensitive data exposure and potential denial-of-service.