CVE-2026-92936: vm2 Package Exposes Host Filesystem Paths via Error Stack Formatting
Summary
CVE-2026-92936: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting. Affects vm2 versions >= 3.11.0, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted code securely. It allows developers to run JavaScript code in a controlled manner, preventing access to the host environment. However, a recent vulnerability has been identified that compromises this security by leaking sensitive filesystem paths.
Vulnerability Detail
The vulnerability arises from the way vm2 handles syntax errors in the sandboxed code. When attacker-controlled code triggers a syntax error, the error stack is returned to the sandbox without proper redaction of sensitive information. This allows the attacker to read absolute paths from the host filesystem, including paths to Node.js internals and the embedding application. The issue affects default configurations of both VM and NodeVM, making it a significant risk for applications using these settings.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider modifying the code to handle errors more securely. For example, avoid exposing the error stack directly to the sandbox. Instead, you can catch errors and return a sanitized message without sensitive information:
const { VM } = require('vm2');
const vm = new VM();
try {
vm.run(`
var s; try { eval("@@@ catch") } catch (e) { s = 'An error occurred'; }
s;
`);
} catch (error) {
console.error('Error running VM:', error);
}
Conclusion
The vm2 package has a vulnerability that allows sensitive filesystem paths to be exposed through error stack formatting. It is crucial to update to the patched version (3.11.7 or later) to protect your application from potential attacks. Implementing secure error handling can also help mitigate risks in the meantime.
See every vulnerability recorded for vm2 →
FAQ
The vulnerability allows attacker-controlled code to read sensitive filesystem paths from the host environment through error stack formatting.
Versions of vm2 from 3.11.0 to 3.11.6 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
The CVSS score of this vulnerability is 5.8, indicating a moderate severity level.
While updating is the best solution, you can implement error handling to avoid exposing sensitive information as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
