CVE-2026-92933: vm2 before 3.11.8 Information Disclosure via util.getCallSites
vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host util module to the sandbox as an unfiltered shallow copy (Object.assign({}, util) in defaultBuiltinLoaderUtil), and the deprecated sys builtin (an alias of host util) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code util.getCallSites(), a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the Error.prepareStackTrace formatting channel. The issue is fixed in vm2 3.11.8.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.8 - Compensating control
If you cannot upgrade immediately, prevent sandboxed/untrusted code from accessing vm2’s generic builtins so it cannot reach the host `util`/`sys` plumbing used to obtain `util.getCallSites()`.
Event History
Frequently Asked Questions
Which deployments are exposed to this information disclosure?
Deployments using vm2 versions 3.11.7 or earlier are affected when sandboxed code can run in NodeVM and the host runs Node.js 22.9 or later. The exposure comes from the built-in util module and the deprecated sys alias being available to the sandbox.
What does an attacker need to exploit the issue?
An attacker needs the ability to execute code inside a vm2 NodeVM sandbox. No privileges or user interaction are required, and the attacker can invoke util.getCallSites() to inspect host stack information.
What information can be disclosed?
The API can return the host process's full call stack, including absolute file paths, function names, line numbers, vm2 bridge internals, and the embedding application's entrypoint.
How can the issue be remediated?
Upgrade vm2 to version 3.11.8, which fixes the issue.
How can I determine whether my environment is affected?
Check whether your application uses vm2 3.11.7 or earlier with NodeVM to execute untrusted code, and whether it runs on Node.js 22.9 or later. In those conditions, sandboxed code may access util.getCallSites() through util or sys.