Description
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| patriksimek | vm2 | < 3.11.2 | 3.11.2 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | vm2 | < 3.11.2 | 3.11.2 | GHSA-2cm2-m3w5-gp2f |
Advisories 1
- WID-SEC-2026-1349 vm2: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 17, 2026
References
- GitHub Security Advisory (GHSA-2cm2-m3w5-gp2f) vendor-advisory
- VulnCheck Advisory: vm2 before 3.11.2 Information Disclosure via Internal State third-party-advisory