Information disclosure in vm2 - #VU146041
Published: August 28, 2026
Vulnerability identifier: #VU146041
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information.
The vulnerability exists due to exposure of sensitive information in the NodeVM builtin loader for the host util and sys modules when handling sandboxed code that accesses util.getCallSites(). A remote attacker can execute sandboxed code that calls util.getCallSites() to disclose sensitive information.
Only configurations that allow the util or sys builtin, including wildcard builtin loading, are vulnerable. Node.js 22.9 or later is required, and the exposed data can include absolute file paths, function names, line numbers, and the embedding application\'s entrypoint.
Affected software
vm2
Remediation
Install security update from vendor's website.
vm2 - update to 3.11.8