Vulnerability GHSA-2cm2-m3w5-gp2f
Medium Risk
MEDIUM RISK
CVSS Score: 5.3
Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
6 months ago
May 08, 2026 at 04:22 PM UTC
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
<3.11.2
<3.11.2
Summary
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
Details
Summary
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.
Details
It is still possible to get access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.
PoC
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Critical
29 days ago
vm2 contains a sandbox escape vulnerability
<3.12.1 GHSA-pq68-rvw4-xp4r
<3.12.1 GHSA-pq68-rvw4-xp4r
Critical
1 month ago
vm2: NodeVM custom resolution bypasses external path boundaries
<3.12.2 GHSA-5h3f-q97h-ccvc
<3.12.2 GHSA-5h3f-q97h-ccvc
High Risk
1 month ago
vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host process
<3.12.2 GHSA-2v2p-6j97-cjg9
<3.12.2 GHSA-2v2p-6j97-cjg9
Critical
1 month ago
vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary
<3.12.2 GHSA-489w-w794-jq94
<3.12.2 GHSA-489w-w794-jq94
High Risk
1 month ago
vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVM
<3.11.8 GHSA-f8gf-w286-fmq2
<3.11.8 GHSA-f8gf-w286-fmq2
Impacted packages
Timeline
Published
6 months ago
May 08, 2026 at 04:22 PM UTC
Fixed (3.11.2)
6 months ago
May 03, 2026 at 09:34 PM UTC
Last Modified
10 hours ago
November 05, 2026 at 10:00 PM UTC