PT-2026-94334 · Npm · Vm2
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
vm2 versions prior to 3.11.2
Description
Insufficient restrictions on access to the
VM2 INTERNAL STATE DO NOT USE OR PROGRAM WILL FAIL global variable allow attackers to access this internal state object via globalThis. This can lead to the disclosure of sensitive sandbox internals.Recommendations
Update to version 3.11.2 or later.
Exploit
Fix
Protection Mechanism Failure
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Vm2