Monthly
Untrusted JavaScript running inside a vm2 sandbox before version 3.11.2 can reach the host-side internal state object via globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'], disclosing sandbox internals that were supposed to be invisible to guest code in the npm package vm2. The issue is a re-bypass of the earlier advisory GHSA-wp5r-2gw5-m7q7, and a short working proof-of-concept is published in the vendor advisory GHSA-2cm2-m3w5-gp2f, so publicly available exploit code exists; no CISA KEV listing appears in the supplied intelligence and no EPSS value was provided. The CVSS 4.0 base score is 6.9 with a confidentiality-only impact (VC:L, VI:N, VA:N, SC:N, PR:N, UI:N), consistent with the independent assessment that this is a genuine but low-severity information disclosure with no demonstrated code execution, integrity, or availability effect; the unauthenticated PR:N rating reflects the vector, while in practice the attacker must already be able to execute code inside the vm2 trust boundary (an application that embeds vm2 and runs attacker-controlled scripts).
Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Data security classification vulnerability in the DDMP module. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Untrusted JavaScript running inside a vm2 sandbox before version 3.11.2 can reach the host-side internal state object via globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'], disclosing sandbox internals that were supposed to be invisible to guest code in the npm package vm2. The issue is a re-bypass of the earlier advisory GHSA-wp5r-2gw5-m7q7, and a short working proof-of-concept is published in the vendor advisory GHSA-2cm2-m3w5-gp2f, so publicly available exploit code exists; no CISA KEV listing appears in the supplied intelligence and no EPSS value was provided. The CVSS 4.0 base score is 6.9 with a confidentiality-only impact (VC:L, VI:N, VA:N, SC:N, PR:N, UI:N), consistent with the independent assessment that this is a genuine but low-severity information disclosure with no demonstrated code execution, integrity, or availability effect; the unauthenticated PR:N rating reflects the vector, while in practice the attacker must already be able to execute code inside the vm2 trust boundary (an application that embeds vm2 and runs attacker-controlled scripts).
Vulnerability of native APIs not being implemented in the NFC service module Impact: Successful exploitation of this vulnerability may cause features to perform abnormally. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.
Data security classification vulnerability in the DDMP module. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.