vm2 EUVD-2026-81613

Requires that the application embeds vm2 (npm/vm2 < 3.11.2) and executes attacker-controlled or untrusted JavaScript inside a vm2 VM/NodeVM instance - this is vm2's core use case, so no non-default configuration is needed. The single concrete step is the sandboxed script reading globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL']. The principal limiting factor is that the attacker must already be able to run code within the sandbox (the assumed vm2 trust boundary); there is no network-facing exploitation independent of that, and impact is limited to disclosure of internal state (no direct code execution, integrity, or availability effect).

This is a genuine but low-severity issue, correctly rated (vendor CVSS 4.0 6.9, confidentiality-only VC:L with VI:N/VA:N and no scope change SC:N). The 4.0 vector shows AV:N/AC:L/AT:N/PR:N/UI:N - trivial to trigger for any actor already permitted to run code in the sandbox, which is the standard vm2 threat model (the sandboxed JS IS the attacker). No EPSS score and no KEV listing are provided, and there is no evidence of active exploitation. However, a working PoC is published directly in the GHSA advisory, so exploit code is public. The impact is bounded: the flaw only discloses vm2's internal state object (VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL) via globalThis - it is information disclosure, not code execution, matching VC:L. Its real significance is as a stepping-stone/reconnaissance primitive: leaking sandbox internals aids the far more serious vm2 escape/RCE chains rather than causing direct harm alone. Notably this is explicitly an incomplete fix of the prior advisory GHSA-wp5r-2gw5-m7q7, a recurring pattern in vm2. Verdict: not an urgent priority in isolation (low confidentiality impact, no active exploitation), but should be patched to 3.11.2+ because any code running under vm2 is by definition untrusted, and this weakens defense-in-depth for the escape CVEs.

An application uses vm2 to run untrusted or third-party JavaScript in a NodeVM/VM sandbox. The attacker-supplied script executes globalThis['VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL'] and receives the internal state object, disclosing sandbox internals it can then use to probe for or build a sandbox-escape. A public PoC exists in the GHSA-2cm2-m3w5-gp2f advisory, and the low attack complexity (AC:L) means it works reliably against any default vm2 instance below 3.11.2.