Executive brief
vm2 is a popular Node.js library that runs untrusted JavaScript code in a sandboxed environment. A flaw in versions 3.11.0–3.11.6 allows attacker-supplied code to bypass sandbox protections and read absolute filesystem paths from the host system, including the embedding application's source code location and internal Node.js paths. While this is information disclosure only with no code execution, it can assist attackers in reconnaissance and chaining into further attacks on vulnerable deployments.
Technical details
The vulnerability is an information disclosure flaw (CWE-209) in vm2's error stack formatting. When sandboxed code triggers a SyntaxError in the host-realm source transformer (by calling eval with malformed input), the error's .stack property is forwarded through the vm2 bridge to the sandbox without sandbox-side redaction, exposing absolute file paths and host function names. The root cause is that the bridge forwards .stack reads directly to the host-realm formatter, bypassing the host-path redaction mechanism previously introduced for GHSA-v27g-jcqj-v8rw. No special configuration or privileges are required; default VM() and NodeVM() configurations are affected. The issue persists even when string eval is disabled, because the host-side transformer throws before eval handling. The attack vector is network (attacker-supplied code) with no authentication required. The impact is information disclosure only; no code execution is possible. Fixed in vm2 3.11.7.
Affected products
- Patriksimek vm2 3.11.0 through 3.11.6
Timeline
- 2026-08-24: disclosed: GitHub Security Advisory GHSA-x6m4-chr9-cg97 published
- 2026-09-17: advisory: CVE-2026-92936 published
- 2026-09-17: patched: Fixed in vm2 3.11.7