vm2 before 3.11.2 Information Disclosure via Internal State

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92963 · CVE overview and exploitation status

EUVD-2026-81613

GHSA-xr25-qx3m-g53h

GHSA-2cm2-m3w5-gp2f

cve-program · CVE-2026-92963

• https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
• https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state

euvd · EUVD-2026-81613

• https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
• https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state

nvd · CVE-2026-92963

• https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
• https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state

osv · GHSA-2cm2-m3w5-gp2f

• https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
• https://github.com/patriksimek/vm2/commit/99d410bb7e0d607c56e68b420720a586dc0dd300
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.2

• vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internal… · Advisory content revised · 11 Nov 2026
• vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` · Advisory content revised · 5 Nov 2026