GHSA-2cm2-m3w5-gp2f
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2026-92963
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
### Summary https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched. ### Details It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`. ### PoC ```js const {VM} = require("vm2"); const vm = new VM(); console.log(vm.run(` globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'] `)); ```
Paquets affectés
| Paquet | Versions |
|---|---|
| npm · vm2 | introduced 0, fixed 3.11.2 |
Références
- https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f WEB
- https://github.com/patriksimek/vm2 PACKAGE
- https://github.com/patriksimek/vm2/releases/tag/v3.11.2 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |