GHSA-2cm2-m3w5-gp2fMedium· 5.3▾ Sunlitvm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
Last analysed / modified upstream
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.
It is still possible to get access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
vm2 < 3.11.2Upgrade to a patched release:
vm2 3.11.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-92963Medium· 5.3vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable
CVE-2026-44003Medium· 5.3vm2's Transformer Fast-Path Bypass Exposes Internal State Variable
CVE-2026-24118Critical· 9.8VM2 Sandbox Breakout Through __lookupGetter__
CVE-2026-26332Critical· 9.8VM2 Has a Sandbox Escape Issue via SuppressedError
GHSA-9hxx-m5g2-2q3hCritical· 10.0Duplicate Advisory: vm2 contains a sandbox escape vulnerability
GHSA-4xmw-hh9q-4q7cCritical· 9.0Duplicate Advisory: vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuit