Access Control Flaw in vm2: Exposure of Internal State Variable
Summary
GHSA-2cm2-m3w5-gp2f: vm2 has access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL. Affects vm2 versions < 3.11.2. Fixed in 3.11.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing JavaScript code securely. It allows developers to run untrusted code with limited access to the host environment, ensuring that potentially harmful scripts cannot compromise the system. However, a vulnerability has been identified that allows unauthorized access to an internal state variable, which could lead to unintended consequences.
Vulnerability Detail
The vulnerability arises from an oversight in the security measures of vm2, specifically related to the variable VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL. This variable is meant to be protected from external access, but it can still be accessed through specific JavaScript code execution. The ramifications of this vulnerability include the potential for attackers to manipulate the internal state of the vm2 environment, leading to security breaches or execution of malicious code. The issue is classified under CWE-693, indicating a failure to protect critical internal state.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.2
This is the first release that contains the fix.
npm install vm2@3.11.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the vm2 package until it has been updated to the patched version. If you must use it, ensure that you do not execute any untrusted code that could potentially access the internal state variable. Here is an example of code that demonstrates the vulnerability:
const { VM } = require('vm2');
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
Conclusion
The vm2 package has a vulnerability that allows access to an internal state variable, posing security risks. It is crucial to update to version 3.11.2 or later to mitigate these risks. Users should also consider using tools like Vulert for real-time monitoring of vulnerabilities in their applications.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
The risks include unauthorized access to the internal state of the vm2 environment, which could lead to security breaches or execution of malicious code.
The best mitigation is to update to the patched version. If that's not possible, avoid executing untrusted code in the vm2 environment.
If you cannot update immediately, refrain from using the vm2 package for executing untrusted code until you can apply the update.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
