Every CVESearch/Get API key

CVE-2026-92963

vm2 before 3.11.2 Information Disclosure via Internal State

6.9 MediumFix available

CVE-2026-92963 is a medium vulnerability (CVSS 6.9) in Patriksimek Vm2, published May 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.34%, the 28th percentile. Fixed in vm2 3.11.2.

What does this mean?
Severity
6.9 MediumCVSS 4.0, CVE List
Exploit chance
0.34%EPSS, 28th percentile
Exploitation
None knownNot on CISA’s or ENISA’s lists
Fixed in
3.11.2vm2 +3 more

Description

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.34%Up 0.1 points since Sep 18, 2026
90%50%10%1%

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vm2
npm
before 3.11.2
3.11.2
vm2
TuxCare:npm
3.10.0-tuxcare.0 up to 3.10.0-tuxcare.1, plus listed versions
3.10.0
3.10.0-tuxcare.1
vm2
Root:npm
before 3.9.17-aikido.11
3.9.17-aikido.113.9.17-aikido.123.10.5-aikido.63.9.17-aikido.133.9.17-aikido.93.9.17-aikido.103.10.5-aikido.73.10.5-aikido.8
@rootio/vm2
Root:npm
before 3.10.5-root.io.5
3.10.5-root.io.53.9.17-root.io.113.9.17-root.io.123.10.5-root.io.63.9.17-root.io.133.9.17-root.io.93.9.17-root.io.103.10.5-root.io.73.10.5-root.io.8

What each source reports

CVE List Score used6.9

vm2 before 3.11.2 Information Disclosure via Internal State

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Record
CVE-2026-92963
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-227
Updated
2026-11-02
EUVDEUVD-2026-816136.9

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Record
EUVD-2026-81613
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-2cm2-m3w5-gp2f5.3

vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

Summary

https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.

Details

It is still possible to get access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.

PoC

const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
Record
GHSA-2cm2-m3w5-gp2f
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-693
Updated
2026-11-05
GitHub AdvisoriesGHSA-xr25-qx3m-g53h6.9

vm2 versions before 3.11.2 fail to properly restrict access to the...

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Record
GHSA-xr25-qx3m-g53h
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
NVD6.9

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Record
CVE-2026-92963
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-227
Updated
2026-11-02
OSV6.9

vm2 before 3.11.2 Information Disclosure via Internal State

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Record
CVE-2026-92963
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Weakness
CWE-227
Updated
2026-11-02
OSVGHSA-2cm2-m3w5-gp2f5.3

vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

Summary

https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.

Details

It is still possible to get access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.

PoC

const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
Record
GHSA-2cm2-m3w5-gp2f
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-693
Updated
2026-11-05
OSVROOT-APP-NPM-GHSA-2cm2-m3w5-gp2f5.3

GHSA-2cm2-m3w5-gp2f in vm2 - Patched by Root

Root has patched GHSA-2cm2-m3w5-gp2f in the vm2 package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-GHSA-2cm2-m3w5-gp2f
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1787860907No score

TuxCare security update for vm2 (34 CVEs)

TuxCare rebuilt vm2 to address 34 CVEs. Fixed in 3.10.0-tuxcare.1.

Record
CLSA-2026-1787860907
Updated
2026-11-02

History

History
RecordedChangedSources
referencesOSV
facts, referencesGitHub Advisories
affected, aliases, references
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

References

PagesAll vulnerabilitiesBrowseDocsSourcesGuideGet API key
MoveEnter Open