A vulnerability in the vm2 library allows access to an internal state object named `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL` in versions prior to 3.11.2. This internal state exposure could potentially lead to unintended information disclosure. The issue has a medium severity rating with a CVSS score of 5.3. A fix is available in version 3.11.2.