{"cve":"CVE-2026-92933","nvd":{"published":"2026-09-17T14:17:57.337","modified":"2026-09-19T03:17:18.310","status":"Deferred","description":"vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9},"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8},"cwes":["CWE-200"],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-r273-hxvj-fxhp","https://www.vulncheck.com/advisories/vm2-before-3.11.8-information-disclosure-via-util-getcallsites","https://github.com/patriksimek/vm2/security/advisories/GHSA-r273-hxvj-fxhp"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:55:23.253742848+00:00"},"epss":{"cve":"CVE-2026-92933","score":0.00372,"percentile":0.31174,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-r273-hxvj-fxhp","url":"https://osv.dev/vulnerability/GHSA-r273-hxvj-fxhp","summary":"vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack","modified":"2026-10-05T22:45:06.581201369Z","packages":[{"ecosystem":"npm","name":"vm2","purl":"pkg:npm/vm2","ranges":["<3.11.8"],"fixed":["3.11.8"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}