vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

概要

const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));

参考情報

• patriksimek/vm2 security advisory · WEB
• patriksimek/vm2 · PACKAGE
• patriksimek/vm2 release v3.11.2 · WEB
• vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state

vm2 のその他の脆弱性

• CVE-2026-100723高 7.5vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers…
• CVE-2026-100722中 6.8vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap …
• CVE-2026-100721緊急 9.0vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` wi…
• CVE-2026-93605緊急 10.0vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite b…
• CVE-2026-92962低 2.1vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function …