CVE-2026-92936: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting
Attacker-controlled code can trigger a host-realm syntax error and read its stack through the vm2 bridge. Host-realm stack formatting bypasses the sandbox-side redaction, so the returned value exposes absolute paths from vm2, Node.js internals, and the embedding application. Default VM and NodeVM configurations are affected without requiring special options.
References
- github.com/advisories/GHSA-x6m4-chr9-cg97
- github.com/patriksimek/vm2/commit/5d5ba5343af571c688a3a81cefad2de25b94180a
- github.com/patriksimek/vm2/releases/tag/v3.11.7
- github.com/patriksimek/vm2/security/advisories/GHSA-x6m4-chr9-cg97
- nvd.nist.gov/vuln/detail/CVE-2026-92936
- www.vulncheck.com/advisories/vm2-3.11.0-before-3.11.7-information-disclosure-via-error-stack
Code Behaviors & Features
Detect and mitigate CVE-2026-92936 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →