CVE-2026-92933: vm2 Package Vulnerability Allows Host Call Stack Leakage
Summary
CVE-2026-92933: vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack. Affects vm2 versions < 3.11.8. Fixed in 3.11.8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted code. It allows developers to run JavaScript code securely by isolating it from the host environment. However, the package has a vulnerability that exposes sensitive information about the host environment, potentially compromising security.
Vulnerability Detail
The vulnerability arises from the exposure of the host 'util' module to the sandbox through an unfiltered shallow copy. This allows sandboxed code to access 'util.getCallSites()', which reveals the host process's full call stack, including absolute file paths, function names, and line numbers. This bypasses previous protections that aimed to redact sensitive host-frame information, leading to potential information disclosure. The vulnerability is particularly concerning as it can leak internal application details and the structure of the host environment, undermining the security model of the vm2 package.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.8
This is the first release that contains the fix.
npm install vm2@3.11.8Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using the 'util' or 'sys' builtins in your NodeVM configuration. You can restrict the builtins by modifying your NodeVM instantiation as follows:
const { NodeVM } = require('vm2');
const vm = new NodeVM({ require: { builtin: [] } });
This will prevent access to the vulnerable APIs until you can update the package.
Conclusion
The vm2 package has a significant vulnerability (CVE-2026-92933) that can lead to the leakage of sensitive host information through the 'util.getCallSites()' API. It is crucial to update to the patched version (3.11.8) to mitigate this risk. Additionally, developers should consider using workarounds to restrict access to vulnerable builtins until they can apply the update.
See every vulnerability recorded for vm2 →
FAQ
CVE-2026-92933 is a vulnerability in the vm2 package that allows untrusted code to access sensitive information about the host environment, including the call stack.
If your application uses vm2 with the vulnerable configuration, untrusted code could potentially read sensitive information about your application's structure and internal functions.
Versions of vm2 up to and including 3.11.7 are affected by this vulnerability. The issue is resolved in version 3.11.8.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of this vulnerability is 5.8, indicating a moderate level of risk associated with its exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
