Exposure in vm2 Sandbox for Node.js by Patrik Simaek

CVE-2026-44002

What is CVE-2026-44002?

The vm2 sandbox for Node.js, developed by Patrik Simaek, contains a vulnerability that allows sandboxed code to access potentially sensitive file path information. In versions prior to 3.11.0, the CallSite wrapper, designed to prevent leakage of host objects, inadvertently permits the unsanitized return of host absolute paths through getFileName(). This could enable malicious actors to retrieve the full directory structure and details about the host server's libraries and frameworks, creating significant security risks.

References