Information Disclosure in vm2 by Patrik Simek

CVE-2026-92936

What is CVE-2026-92936?

The vm2 library, versions 3.11.0 to 3.11.6, contains a vulnerability that allows absolute host filesystem paths to be leaked to sandboxed code through error stack traces. When an attacker provides crafted input that triggers a SyntaxError (for instance, by using eval with improper source), the error's .stack property becomes accessible. This bypasses the safeguards intended to redact host paths, exposing sensitive internal paths from Node.js and the embedding application's source code. This information disclosure occurs even without specific configurations and continues to pose a risk when string evaluation is disabled, due to the behavior of the host-side error transformer. The issue has been resolved in vm2 version 3.11.7.

References