PT-2026-38393 · Npm · Vm2

Kodove · Published 2026-05-07 · Updated 2026-06-04 · CVE-2026-44002

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.0

Description The CallSite wrapper class, designed as a safe wrapper for V8's native CallSite, fails to sanitize the output of the getFileName() function. While the class blocks getThis() and getFunction() to prevent host object leakage, getFileName() can return unsanitized absolute paths from the host. This allows sandboxed code to extract the host server's full directory structure, library paths, and framework versions. This information disclosure can occur via the default error.stack or by using a custom prepareStackTrace to call getFileName() on each CallSite.

Recommendations Update to version 3.11.0.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

BDU:2026-06966

CVE-2026-44002

GHSA-V27G-JCQJ-V8RW

Affected Products

Vm2

References · 7

• https://github.com/patriksimek/vm2/security/advisories/GHSA-v27g-jcqj-v8rw · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v27g-jcqj-v8rw · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-44002 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-44002 · Security Note
• https://bdu.fstec.ru/vul/2026-06966 · Security Note
• https://github.com/patriksimek/vm2 · Note
• https://github.com/patriksimek/vm2/releases/tag/v3.11.0 · Note