CVE-2026-92963

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-92963", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-17T12:43:31.528Z", "datePublished": "2026-09-17T13:46:18.972Z", "dateUpdated": "2026-09-18T19:15:28.242Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-17T13:46:18.972Z"}, "datePublic": "2026-05-03T00:00:00.000Z", "title": "vm2 before 3.11.2 Information Disclosure via Internal State", "descriptions": [{"lang": "en", "value": "vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-227", "cweId": "CWE-227", "type": "CWE"}]}], "affected": [{"vendor": "patriksimek", "product": "vm2", "defaultStatus": "unaffected", "packageURL": "pkg:npm/vm2", "versions": [{"version": "0", "status": "affected", "versionType": "semver", "lessThan": "3.11.2"}, {"version": "3.11.2", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-2cm2-m3w5-gp2f)"}, {"name": "VulnCheck Advisory: vm2 before 3.11.2 Information Disclosure via Internal State", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state"}], "credits": [{"lang": "en", "value": "XmiliaH", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-18T19:15:22.911322Z", "id": "CVE-2026-92963", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:15:28.242Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-92963", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T19:15:22.911322Z"}}}], "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T19:15:06.338Z"}}], "cna": {"title": "vm2 before 3.11.2 Information Disclosure via Internal State", "credits": [{"lang": "en", "type": "reporter", "value": "XmiliaH"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}}], "affected": [{"vendor": "patriksimek", "product": "vm2", "versions": [{"status": "affected", "version": "0", "lessThan": "3.11.2", "versionType": "semver"}, {"status": "unaffected", "version": "3.11.2", "versionType": "semver"}], "packageURL": "pkg:npm/vm2", "defaultStatus": "unaffected"}], "datePublic": "2026-05-03T00:00:00.000Z", "references": [{"url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f", "name": "GitHub Security Advisory (GHSA-2cm2-m3w5-gp2f)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state", "name": "VulnCheck Advisory: vm2 before 3.11.2 Information Disclosure via Internal State", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-227", "description": "CWE-227"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-17T13:46:18.972Z"}}}, "cveMetadata": {"cveId": "CVE-2026-92963", "state": "PUBLISHED", "dateUpdated": "2026-09-18T19:15:28.242Z", "dateReserved": "2026-09-17T12:43:31.528Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-17T13:46:18.972Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/vm2", "product": "vm2", "vendor": "patriksimek", "versions": [{"lessThan": "3.11.2", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "3.11.2", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. Attackers can access this internal state object through globalThis to retrieve sensitive sandbox internals."}], "id": "CVE-2026-92963", "lastModified": "2026-09-18T20:17:31.370", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92963", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T19:15:22.911322Z", "version": "2.0.3"}}]}, "published": "2026-09-17T14:18:02.783", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-227"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "vm2: vm2: Sensitive information disclosure due to internal state access", "id": "2536030", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2536030"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "status": "draft"}, "cwe": "CWE-767", "details": ["A flaw was found in vm2. An attacker can exploit this vulnerability by improperly accessing the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable through globalThis. This allows the attacker to retrieve sensitive internal information from the sandbox environment, leading to information disclosure."], "name": "CVE-2026-92963", "public_date": "2026-09-17T13:46:18Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-92963\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-92963\nhttps://github.com/patriksimek/vm2/security/advisories/GHSA-2cm2-m3w5-gp2f\nhttps://www.vulncheck.com/advisories/vm2-before-3.11.2-information-disclosure-via-internal-state"], "statement": "This Moderate impact information disclosure vulnerability in vm2 allows attackers to access sensitive sandbox internals. However, Red Hat products are not affected by this flaw as the vulnerable code is not present in Red Hat's supported offerings.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.11.2)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "3.11.2"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "vm2", "source": "cna", "vendor": "patriksimek"}, "product": "vm2", "vendor": "patriksimek"}], "created": "2026-09-17T23:30:16.947683+00:00", "updated": "2026-09-18T00:30:16.964580+00:00", "vendors": ["patriksimek", "patriksimek$PRODUCT$vm2"]}