Executive Summary
A vulnerability in vm2, identified as CVE-2026-47683 with a CVSS score of 8.7, allows untrusted sandbox code to bypass the bufferAllocLimit cap. This cap is designed to prevent sandbox code from allocating excessive host-side Buffer memory, which could lead to a Denial of Service (DoS) attack. The bypass is achieved through the use of `Buffer.concat` and `Buffer.from` with an array-like object.
Technical Analysis
The `bufferAllocLimit` option, introduced in vm2 version 3.11.0, is designed to cap host-side Buffer allocations driven by sandbox code. However, two API paths are not capped: `Buffer.concat(list, totalLength)` and `Buffer.from(arrayLike)` with a fake `length`. An attacker can exploit this vulnerability by using either of these paths to allocate an arbitrary number of host external bytes in a single call, effectively defeating the DoS mitigation configured by the embedder.
How It Gets Exploited
An attacker would exploit this vulnerability by crafting a malicious payload that utilizes `Buffer.concat` or `Buffer.from` with an array-like object to bypass the `bufferAllocLimit` cap. For example, an attacker could use the following code to allocate 50 MiB of host external memory:
```javascript
vm2.run('Buffer.concat([Buffer.from("a")], 50 * 1024 * 1024)')
```
This code would allocate 50 MiB of host external memory in a single call, potentially leading to a DoS attack.
Impact Assessment
The impact of this vulnerability is a potential DoS attack, where an attacker could cause the host process to run out of memory. The vulnerability affects vm2 versions prior to the fix, which uses the existing `checkBufferAllocLimit(size)` helper and a sandbox-side wrapper installed via `connect(...)` to cap the allocations.
Recommended Actions
To mitigate this vulnerability, it is recommended to update vm2 to a version that includes the fix, which caps the allocations for `Buffer.concat` and `Buffer.from` with an array-like object. Specifically, update to a version where the `checkBufferAllocLimit(size)` helper and sandbox-side wrappers are properly installed.
Sources
- GitHub Security Advisories: https://github.com/advisories/GHSA-gmc2-2x9w-cgh9