Executive brief
vm2 is a Node.js sandbox for safely running untrusted code. In versions up to 3.11.7, a bug in how the sandbox exposes the built-in `util` module allows an attacker to call `util.getCallSites()` and obtain sensitive internal information about the host application—including file paths, function names, and line numbers from vm2 internals and the embedding application. This information disclosure can be leveraged to craft targeted exploits against the host system.
Technical details
The vulnerability is a information disclosure (CWE-200) flaw in vm2's builtin module loading. The `defaultBuiltinLoaderUtil` function in `lib/builtin.js` performs an unfiltered shallow copy of the host `util` module (`Object.assign({}, util)`) and wraps it in `vm.readonly()`, automatically exposing all static members—including the new `util.getCallSites()` API added in Node.js 22.9+. This function returns the host process's full call stack including absolute paths and internal frame data. The `sys` builtin (deprecated alias of `util`) suffers from the same issue via the generic builtin loader. Prior protections (GHSA-v27g) only redacted host frames during `Error.prepareStackTrace` formatting; `util.getCallSites()` generates data host-side and bypasses this formatter entirely. The issue is fixed in vm2 3.11.8 by filtering the exposed `util` module to exclude stack-introspection APIs.
Affected products
- vm2 vm2 <=3.11.7
Timeline
- 2026-08-27: disclosed: GitHub Security Advisory GHSA-r273-hxvj-fxhp published
- 2026-09-17: advisory: CVE-2026-92933 published on NVD
- 2026: patched: Fixed in vm2 3.11.8