Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-17T13:46:18 vm2: vm2: Sensitive information disclosure due to internal state access 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N CWE-767

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals.

A flaw was found in vm2. An attacker can exploit this vulnerability by improperly accessing the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable through globalThis. This allows the attacker to retrieve sensitive internal information from the sandbox environment, leading to information disclosure.

This Moderate impact information disclosure vulnerability in vm2 allows attackers to access sensitive sandbox internals. However, Red Hat products are not affected by this flaw as the vulnerable code is not present in Red Hat's supported offerings. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Red Hat Developer Hub Not affected rhdh/red-hat-developer-hub-backstage-plugin-lightspeed-backend Red Hat Developer Hub Not affected rhdh/red-hat-developer-hub-backstage-plugin-orchestrator-backend Red Hat Developer Hub Not affected rhdh/rhdh-hub-rhel9 Self-service automation portal 2 Not affected ansible-automation-platform/automation-portal Self-service automation portal 2 Not affected ansible-automation-platform/bootc-automation-portal-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-92963 https://nvd.nist.gov/vuln/detail/CVE-2026-92963 https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state