Skip to content
fr Sign in
6.9 Medium

CVE-2026-92933 vm2 is a sandbox for running untrusted Node.js code

Description

vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.

Affected products and versions

Product Affected versions Fixed in
vm2 3.11 earliest → < 3.11.8 3.11.8

References

Timeline

  1. Published
  2. Last modified

Other CVEs of vm2

The 77 CVEs of vm2 →
CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength… 6.9 Medium CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap 8.9 High CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver 9.5 Critical CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM` 10.0 Critical
Track this CVE