The vm2 library versions prior to 3.11.2 do not adequately restrict access to an internal global variable named VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL. Attackers can exploit this by accessing the variable through globalThis, thereby retrieving sensitive sandbox internals. This vulnerability is categorized under CWE-227 (Improper Protection of Alternate Path) and has a CVSS 4.0 base score of 6.9, reflecting a medium severity network attack vector with low complexity and no privileges or user interaction required.

An attacker can gain access to sensitive internal state information of the vm2 sandbox environment, potentially undermining the sandbox's security guarantees. This could lead to further exploitation depending on how the internal state is used or protected. However, no known exploits are reported in the wild at this time.

A fix is available in vm2 version 3.11.2. Users should upgrade to version 3.11.2 or later to remediate this vulnerability. No additional mitigation steps are indicated.