{"id":"GHSA-2cm2-m3w5-gp2f","kind":"vulnerability","aliases":["GHSA-2cm2-m3w5-gp2f"],"related":[],"title":"vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`","description":"### Summary\n\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.\n\n### Details\n\nIt is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`.\n\n### PoC\n\n```js\nconst {VM} = require(\"vm2\");\nconst vm = new VM();\nconsole.log(vm.run(`\n globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']\n`));\n```","summary":"The vm2 npm package is a JavaScript sandbox, and an incomplete earlier fix still lets code inside the sandbox reach its internal state object by name. Code run through vm2 can read internal state that should stay hidden from it, which can lead to escaping the sandbox.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vm2","fixed":["3.11.2"],"affected":"< 3.11.2","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-693","node.js","npm","package","vm2"],"not_affected_if":["trusted-code-only","vm2-not-installed"],"how_to_check":"- Run `npm ls vm2` in the project to find every installed copy of vm2 and its version.\n- Check the lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for vm2 entries below `3.11.2`.","fix":"- `vm2` `3.11.2` (fixed version per the advisory's product range).","status":"open","published_at":"2026-05-08T16:22:52+00:00","first_seen_at":"2026-11-05T21:44:25+00:00","triaged_at":"2026-11-05T21:45:25+00:00","updated_at":"2026-11-05T21:45:25+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-05T21:45:25Z","model":"claude-haiku-5-5","output":{"fix":"- `vm2` `3.11.2` (fixed version per the advisory's product range).","reach":"local","title":"vm2: sandbox leaks internal state object to untrusted code","impact":"medium","summary":"The vm2 npm package is a JavaScript sandbox, and an incomplete earlier fix still lets code inside the sandbox reach its internal state object by name. Code run through vm2 can read internal state that should stay hidden from it, which can lead to escaping the sandbox.","audience":"developers","category":"package","nicknames":[],"who_cares":["npm","vm2","node.js"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"sandboxed code reads internal state and may escape the sandbox","analyst_note":"","how_to_check":"- Run `npm ls vm2` in the project to find every installed copy of vm2 and its version.\n- Check the lockfile (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`) for vm2 entries below `3.11.2`.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-code-only","vm2-not-installed"],"who_is_affected":"Any application that runs untrusted or user-supplied JavaScript through vm2 is exposed, because the sandbox boundary is the protection. Projects that only use vm2 for trusted code, or that no longer depend on it, can skip it. The sources do not describe further conditions.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"unknown"},"cost_usd":0.000718,"input_tokens":4466,"output_tokens":543,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-693':27B '/patriksimek/vm2/security/advisories/ghsa-wp5r-2gw5-m7q7':82C '2cm2':17A,22A 'access':3A,94C 'code':47B,58B 'console.log':116C 'const':108C,112C 'cwe':26B 'detail':87C 'earlier':43B 'escap':76B 'fail':14A,105C,128C 'fix':44B 'fulli':85C 'get':93C 'ghsa':16A,21A 'ghsa-2cm2-m3w5-gp2f':15A,20A 'github.com':81C 'github.com/patriksimek/vm2/security/advisories/ghsa-wp5r-2gw5-m7q7':80C 'globalthi':118C 'gp2f':19A,24A 'hidden':69B 'incomplet':42B 'insid':48B 'intern':6A,53B,64B,97C,120C 'javascript':38B 'js':107C 'lead':74B 'let':46B 'm3w5':18A,23A 'name':57B 'new':114C 'node.js':28B 'npm':29B,34B 'object':55B 'packag':30B,35B 'patch':86C 'poc':106C 'possibl':91C 'program':12A,103C,126C 'reach':51B 'read':63B 'requir':110C 'run':59B 'sandbox':39B,50B,78B 'state':7A,54B,65B,98C,121C 'stay':68B 'still':45B,90C 'summari':79C 'use':10A,101C,124C 'vm':109C,113C,115C 'vm.run':117C 'vm2':1A,5A,25A,31B,33B,61B,96C,111C,119C","nicknames":[],"mitigations":[],"who_affected":"Any application that runs untrusted or user-supplied JavaScript through vm2 is exposed, because the sandbox boundary is the protection. Projects that only use vm2 for trusted code, or that no longer depend on it, can skip it. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["vm2"],"ptokens":["vm2"],"labels":["cwe693","medium","nodejs","npm","package","vm2"],"campaign_type":null,"search_a":"'2cm2':17A,22A 'access':3A 'fail':14A 'ghsa':16A,21A 'ghsa-2cm2-m3w5-gp2f':15A,20A 'gp2f':19A,24A 'intern':6A 'm3w5':18A,23A 'program':12A 'state':7A 'use':10A 'vm2':1A,5A,25A","search_b":"'-693':27B 'code':47B,58B 'cwe':26B 'earlier':43B 'escap':76B 'fix':44B 'hidden':69B 'incomplet':42B 'insid':48B 'intern':53B,64B 'javascript':38B 'lead':74B 'let':46B 'name':57B 'node.js':28B 'npm':29B,34B 'object':55B 'packag':30B,35B 'reach':51B 'read':63B 'run':59B 'sandbox':39B,50B,78B 'state':54B,65B 'stay':68B 'still':45B 'vm2':31B,33B,61B","search_c":"'/patriksimek/vm2/security/advisories/ghsa-wp5r-2gw5-m7q7':82C 'access':94C 'console.log':116C 'const':108C,112C 'detail':87C 'fail':105C,128C 'fulli':85C 'get':93C 'github.com':81C 'github.com/patriksimek/vm2/security/advisories/ghsa-wp5r-2gw5-m7q7':80C 'globalthi':118C 'intern':97C,120C 'js':107C 'new':114C 'patch':86C 'poc':106C 'possibl':91C 'program':103C,126C 'requir':110C 'state':98C,121C 'still':90C 'summari':79C 'use':101C,124C 'vm':109C,113C,115C 'vm.run':117C 'vm2':96C,111C,119C","first_public_at":"2026-05-08T16:22:52+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-2cm2-m3w5-gp2f","url":"https://github.com/advisories/GHSA-2cm2-m3w5-gp2f","severity":"medium","published_at":"2026-05-08T16:22:52+00:00","modified_at":"2026-11-05T21:42:53+00:00","first_seen_at":"2026-11-05T21:44:25+00:00","fetched_at":"2026-11-05T21:44:25+00:00","note":null}],"documents":[{"id":80621,"url":"https://api.github.com/repos/patriksimek/vm2/security-advisories/GHSA-2cm2-m3w5-gp2f","title":"Maintainer's advisory: api.github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: api.github.com"},{"id":80622,"url":"https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":63614,"url":"https://github.com/patriksimek/vm2/releases/tag/v3.11.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"},{"id":80624,"url":"https://github.com/patriksimek/vm2/commit/99d410bb7e0d607c56e68b420720a586dc0dd300","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}