vm2 before 3.11.2 Information Disclosure via Internal State
cve-program · CVE-2026-92963
Publishedvm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
Read the publisher's advisoryeuvd · EUVD-2026-81613
Publishedvm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
Read the publisher's advisorynvd · CVE-2026-92963
Publishedvm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
Read the publisher's advisoryosv · GHSA-2cm2-m3w5-gp2f
Published### Summary https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched. ### Details It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`. ### PoC ```js const {VM} = require("vm2"); const vm = new VM(); console.log(vm.run(` globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'] `)); ```
Read the publisher's advisoryAffected versions, risk and source history
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2026-92963 · CVE overview and exploitation status
cve-program · CVE-2026-92963
- https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
- https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state
euvd · EUVD-2026-81613
- https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
- https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state
nvd · CVE-2026-92963
- https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
- https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state
osv · GHSA-2cm2-m3w5-gp2f
Related changes
Linked by CVE identifier- vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internal… · Advisory content revised · 11 Nov 2026
- vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` · Advisory content revised · 5 Nov 2026