CVE-2026-92963: vm2 before 3.11.2 Information Disclosure via Internal State
vm2 versions before 3.11.2 fail to properly restrict access to the VM2INTERNALSTATEDONOTUSEORPROGRAMWILLFAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using npm/vm2 versions before 3.11.2 are affected if untrusted code can execute within a vm2 sandbox. The issue allows that code to access sandbox internals through globalThis.
Does exploitation require authentication or user interaction?
No. The supplied vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What information can an attacker obtain?
An attacker can retrieve sensitive sandbox internals by accessing the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable through globalThis. The provided impact information indicates low confidentiality impact and no integrity or availability impact.
What version should be used to remediate the issue?
Upgrade vm2 to version 3.11.2 or later. Versions before 3.11.2 are described as failing to properly restrict access to the internal-state global variable.