CVE-2026-92963 — vm2 before 3.11.2 Information Disclosure via Internal State
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state o…
Published: 2026-09-17 · CVSS: 6.9 · CVSS 4.0
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7