Executive brief
vm2 is a Node.js sandbox that executes untrusted code in an isolated environment. A vulnerability allows sandboxed code to access the `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` object through computed-key access on globalThis, potentially exposing sensitive internal bridge state. While the immediate risk is information disclosure, access to internal state may enable further exploitation or sandbox escape.
Technical details
The vulnerability is an information disclosure issue (CWE-693) in vm2's sandbox isolation mechanism. A prior patch (GHSA-wp5r-2gw5-m7q7) attempted to restrict access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`, but the fix was incomplete. An attacker can bypass the restriction by using computed-key access on globalThis (e.g., `globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']`) to retrieve the internal state object. This requires no privileges, no user interaction, and is reachable over the network from any VM instance. The impact is low confidentiality loss; access to internal state does not directly achieve code execution but may leak sensitive bridge information or enable chained attacks. A fix was released in version 3.11.2.
Affected products
- patriksimek vm2 <3.11.2
Timeline
- 2026-05-03: disclosed
- 2026-05-03: patched: Fixed in version 3.11.2