CVE-2026-92933: vm2 sandbox escape via util.getCallSites information disclosure

CVE-2026-92933 · Severity: medium · CVSS 5.8 · Published 2026-09-17

vm2 is a Node.js sandbox for safely running untrusted code. In versions up to 3.11.7, a bug in how the sandbox exposes the built-in `util` module allows an attacker to call `util.getCallSites()` and obtain sensitive internal information about the host application—including file paths, function names, and line numbers from vm2 internals and the embedding application. This information disclosure can be leveraged to craft targeted exploits against the host system.

Technologies: vm2 (npm). Vendors: npm.

Quick answers

Is CVE-2026-92933 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92933 being exploited in the wild.
How severe is CVE-2026-92933?
Medium severity, with a CVSS score of 5.8, published 17 September 2026.
Which products and versions are affected?
vm2 (npm) <= 3.11.7, SEMVER:introduced=0,fixed=3.11.8.
Is there a fix for CVE-2026-92933?
Yes. vm2 (npm): upgrade to 3.11.8 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92933 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-92933?
Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vm2 (npm): upgrade to 3.11.8 or later
    npm install vm2@3.11.8

Technical details

The vulnerability is a information disclosure (CWE-200) flaw in vm2's builtin module loading. The `defaultBuiltinLoaderUtil` function in `lib/builtin.js` performs an unfiltered shallow copy of the host `util` module (`Object.assign({}, util)`) and wraps it in `vm.readonly()`, automatically exposing all static members—including the new `util.getCallSites()` API added in Node.js 22.9+. This function returns the host process's full call stack including absolute paths and internal frame data. The `sys` builtin (deprecated alias of `util`) suffers from the same issue via the generic builtin loader. Prior protections (GHSA-v27g) only redacted host frames during `Error.prepareStackTrace` formatting; `util.getCallSites()` generates data host-side and bypasses this formatter entirely. The issue is fixed in vm2 3.11.8 by filtering the exposed `util` module to exclude stack-introspection APIs.

Affected products

  • vm2 vm2 <=3.11.7

Identifiers

  • CVE-2026-92933
  • GHSA-r273-hxvj-fxhp

Timeline

  • 2026-08-27: disclosed: GitHub Security Advisory GHSA-r273-hxvj-fxhp published
  • 2026-09-17: advisory: CVE-2026-92933 published on NVD
  • 2026: patched: Fixed in vm2 3.11.8

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.