The vulnerability in vm2 (CVE-2026-47683) arises from incomplete enforcement of the bufferAllocLimit in lib/setup-sandbox.js. Specifically, the enforcement does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) when the length is attacker-controlled. This allows sandboxed code to allocate large amounts of host memory synchronously, bypassing the intended memory cap and potentially exhausting the host process. The problem is resolved in version 3.11.6 of vm2.

An attacker executing code within the vm2 sandbox can bypass memory allocation limits and cause large synchronous allocations of host external memory. This can exhaust the host process's memory resources, potentially leading to denial of service conditions. There is no indication of privilege escalation or code execution outside the sandbox beyond resource exhaustion.

Upgrade vm2 to version 3.11.6 or later, where the bufferAllocLimit enforcement covers all relevant Buffer allocation methods and prevents bypass. No other mitigation is indicated or necessary as the issue is fixed in this version.