CVE-2026-92963

5.3 Moyenne

Publiée le 17/09/2026 à 16:18 · Modifiée le 18/09/2026 à 22:17 · Analyse NVD reportée · Source : disclosure@vulncheck.com

Description

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

Traduire en français

Produits concernés

patriksimek vm2

Scores CVSS

Version	Score	Source	Vecteur
4.0	6.9 Moyenne	disclosure@vulncheck.com	`CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
3.1	5.3 Moyenne	disclosure@vulncheck.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-227

Références

https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f
https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state
https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories