Medium severity5.3OSV Advisory· Published Sep 17, 2026· Updated Sep 18, 2026
CVE-2026-92963
CVE-2026-92963
Description
vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: v3.11.1, v3.11.0, v3.10.5, …
Patches
Vulnerability mechanics
References
2News mentions
1- vm2 npm Package: 25 Critical Sandbox Escape Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 18, 2026