Read the docs
TI-2026-66724 Aliases GHSA-2cm2-m3w5-gp2f

vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

Priority LOW 38CWE-693Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
Security bypass
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub. Impact type from CWE-693.

Summary

### Summary https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched. ### Details It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`. ### PoC ```js const {VM} = require("vm2"); const vm = new VM(); console.log(vm.run(` globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'] `)); ```

Why it matters now

Fix Fixed vm2 (npm): 3.11.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—vm2 (npm)before 3.11.23.11.2Patch availableGHSA-2cm2-m3w5-gp2f
  • vm2 (npm) Vendor— Affected before 3.11.2 Fixed in 3.11.2 Patch available GHSA-2cm2-m3w5-gp2f

Remediation

  • Fix · GHSA-2cm2-m3w5-gp2f vm2 (npm) Fixed in 3.11.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-2cm2-m3w5-gp2f
  2. 2026-11-05 1 new reference · GHSA-2cm2-m3w5-gp2f

References

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences