vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`

Mô tả

const {VM} = require("vm2");
const vm = new VM();
console.log(vm.run(`
 globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']
`));

Tham khảo

• patriksimek/vm2 security advisory · WEB
• patriksimek/vm2 · PACKAGE
• patriksimek/vm2 release v3.11.2 · WEB
• vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state

Lỗ hổng khác của vm2

• CVE-2026-100723CAO 7.5vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers…
• CVE-2026-100722TRUNG BÌNH 6.8vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap …
• CVE-2026-100721NGHIÊM TRỌNG 9.0vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` wi…
• CVE-2026-93605NGHIÊM TRỌNG 10.0vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite b…
• CVE-2026-92962THẤP 2.1vm2 is a sandbox for running untrusted JavaScript. In vm2 versions up to and including 3.11.3, the defaultSandboxPrepareStackTrace function …