p PatchFirst

CVE-2026-92963

CVE-2026-92963 · vm2 before 3.11.2 Information Disclosure via Internal State

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

CVSS 6.9 · Medium · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • ≥ 0, < 3.11.2: Affected (semver)
    • 3.11.2: Not affected (semver)

    Update to 3.11.2

  • vm2 npm

    Affected ranges
    • SEMVER: < 3.11.2

    Update to 3.11.2

Original sources

Check your server →