Aller au contenu
en Se connecter
6.9 Moyenne

CVE-2026-92933 vm2 is a sandbox for running untrusted Node.js code

Description

vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.

Produits et versions touchés

Produit Versions touchées Corrigé en
vm2 3.11 premières → < 3.11.8 3.11.8

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de vm2

Les 77 CVE de vm2 →
CVE-2026-100723 vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength… 6.9 Moyenne CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap 8.9 Élevée CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver 9.5 Critique CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM` 10.0 Critique
Suivre cette CVE