Duplicate Advisory: vm2: vm.freeze()/vm.readonly() bypass via accessor descriptor
## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-633r-hq9m-c4ff. This link is maintained to preserve external references. ## Original Description vm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass vm.freeze() and vm.readonly() protections. Attackers can use Object.getOwnPropertyDescriptor() or __lookupSetter__() to extract and invoke host object setters directly, mutating properties the embedder explicitly marked read-only.
GHSA-9f3g-34x8-92jc
Primary source · Revision 1 · Withdrawn
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-9f3g-34x8-92jc
vm2
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "3.9.6"
},
{
"last_affected": "3.11.6"
}
]
}
],
"package": {
"name": "vm2",
"purl": "pkg:npm/vm2",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-9f3g-34x8-92jc/GHSA-9f3g-34x8-92jc.json"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #61275 · Revision 1
- Added to Heist Feed
- Publisher date