Information Disclosure in vm2 Sandbox for Node.js Code by Patrik Simek

CVE-2026-92933

What is CVE-2026-92933?

The vm2 sandbox, designed for executing untrusted Node.js code, contains a vulnerability in versions up to 3.11.7 that allows unauthorized access to the host 'util' module. This occurs because NodeVM exposes an unfiltered shallow copy of the 'util' module as well as the deprecated 'sys' builtin. Particularly, on Node.js versions 22.9 and above, the compromised sandbox environment grants access to 'util.getCallSites()', enabling malicious actors to programmatically retrieve the full call stack of the host process, including sensitive details such as absolute file paths and function names. This exposes the internal workings of the vm2 bridge and the embedding application, breaching any prior host-frame redaction measures. The issue was resolved in version 3.11.8 of vm2.

References