{"id":"GHSA-2vh9-cv26-p97m","revision":null,"records":[{"revision":"1528f1f9ea554475863c309540417f32","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92933","aliases":[],"title":"vm2 before 3.11.8 Information Disclosure via util.getCallSites","description":"vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.","state":0,"publishedAt":"2026-09-17T13:45:59.246+00:00","modifiedAt":"2026-09-19T02:27:07.171+00:00","affected":[{"ecosystem":"Vendor product","name":"vm2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"patriksimek\",\n                    \"product\": \"vm2\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/vm2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.11.8\"\n                        },\n                        {\n                            \"version\": \"3.11.8\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-r273-hxvj-fxhp","https://www.vulncheck.com/advisories/vm2-before-3.11.8-information-disclosure-via-util-getcallsites"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92933","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92933","identifiers":["CVE-2026-92933"]},"retained":false,"historicalAffected":[]},{"revision":"5e6ac9452efa459186b7418bd0f19a91","observedAt":"2026-11-09T17:15:30.477+00:00","statement":{"source":"euvd","id":"EUVD-2026-81583","aliases":["CVE-2026-92933","GHSA-2vh9-cv26-p97m","GHSA-r273-hxvj-fxhp"],"title":"vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sy…","description":"vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":6.9,"severity":null}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-r273-hxvj-fxhp","https://www.vulncheck.com/advisories/vm2-before-3.11.8-information-disclosure-via-util-getcallsites"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81583","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 17, 2026, 1:45:59 PM","dateUpdated":"Sep 19, 2026, 2:27:07 AM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-3071","title":"vm2: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-92933","CVE-2026-92934","CVE-2026-92953","CVE-2026-92955","CVE-2026-92959","CVE-2026-92936"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-81583","identifiers":["EUVD-2026-81583","CVE-2026-92933","GHSA-2vh9-cv26-p97m","GHSA-r273-hxvj-fxhp"]},"retained":false,"historicalAffected":[]},{"revision":"06f75a4f60f1477685460ea1c9c76281","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-92933","aliases":[],"title":"vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sy…","description":"vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.","state":0,"publishedAt":"2026-09-17T14:17:57.337+00:00","modifiedAt":"2026-09-19T03:17:18.31+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":6.9,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":5.8,"severity":"MEDIUM"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-r273-hxvj-fxhp","https://www.vulncheck.com/advisories/vm2-before-3.11.8-information-disclosure-via-util-getcallsites"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92933","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-200"],"productCriteria":[],"sourceDates":{"published":"2026-09-17T14:17:57.337","lastModified":"2026-09-19T03:17:18.310"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-92933","identifiers":["CVE-2026-92933"]},"retained":false,"historicalAffected":[]},{"revision":"f5f542c9332c436caafa4fd2889e54ea","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-2vh9-cv26-p97m","aliases":[],"title":"Duplicate Advisory: vm2: util.getCallSites() bypasses GHSA-v27g host-frame redaction, leaks host call stack","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00A0GHSA-r273-hxvj-fxhp. This link is maintained to preserve external references.\n\n## Original Description\nvm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated `sys` builtin (an alias of host `util`) is exposed through the generic builtin loader. On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack, including absolute file paths, function names, and line numbers for vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction introduced for GHSA-v27g-jcqj-v8rw, which only applies to the `Error.prepareStackTrace` formatting channel. The issue is fixed in vm2 3.11.8.","state":2,"publishedAt":"2026-09-17T15:32:14+00:00","modifiedAt":"2026-10-05T22:45:04.5502572+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"3.11.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-r273-hxvj-fxhp","https://nvd.nist.gov/vuln/detail/CVE-2026-92933","https://www.vulncheck.com/advisories/vm2-before-3.11.8-information-disclosure-via-util-getcallsites"],"sourceUrl":"https://github.com/advisories/GHSA-2vh9-cv26-p97m","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2vh9-cv26-p97m","identifiers":["GHSA-2vh9-cv26-p97m"]},"retained":false,"historicalAffected":[]},{"revision":"d76dd61c29904da1baea61edc0811681","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-r273-hxvj-fxhp","aliases":["CVE-2026-92933"],"title":"vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stack","description":"### Summary\n\nNodeVM exposes the host `util` module to the sandbox through an unfiltered shallow copy (`Object.assign({}, util)`). On Node.js >= 22.9 this hands sandboxed code `util.getCallSites()`, a programmatic stack-introspection API that returns the host process's full call stack — absolute file paths, function names, and line numbers — including vm2 bridge internals and the embedding application's entrypoint. This bypasses the host-frame redaction established in GHSA-v27g-jcqj-v8rw, which only covers the `Error.prepareStackTrace` channel.\n\n### Details\n\n- Root cause — `defaultBuiltinLoaderUtil` copies every static member of the host `util` module and wraps the copy in `vm.readonly()` without filtering any member, so newly added Node APIs land in the sandbox automatically:\n  https://github.com/patriksimek/vm2/blob/7a1f5100b96f48d34e0fe104ab37c0acc5944f92/lib/builtin.js#L25-L38\n- Second equivalent channel — the deprecated `sys` builtin (an alias of host `util`) goes through the generic builtin loader `vm.readonly(hostRequire(key))`, which also carries `getCallSites`:\n  https://github.com/patriksimek/vm2/blob/7a1f5100b96f48d34e0fe104ab37c0acc5944f92/lib/builtin.js#L230\n- Bypassed protection — GHSA-v27g's redaction (`isHostFrameFileName` + `applyCallSiteGetters`) rewrites host-frame metadata getters to `null` only when the *sandbox realm* formats an error stack:\n  https://github.com/patriksimek/vm2/blob/7a1f5100b96f48d34e0fe104ab37c0acc5944f92/lib/setup-sandbox.js#L818-L870\n\n`util.getCallSites()` produces its data host-side and never passes through that formatter, so frames such as `lib/bridge.js @apply` (the bridge apply trap), `lib/nodevm.js @run`, the embedder's own entry file, and `node:internal/*` frames reach the sandbox verbatim as data properties (`scriptName`, `functionName`, `lineNumber`, `columnNumber`, `scriptId`). A repository-wide grep (source, docs/ATTACKS.md, CHANGELOG, tests) shows no occurrence of `getCallSites`; the member was never considered.\n\n### PoC\n\nPrerequisites: Node.js >= 22.9 (verified on v22.23.1); run `npm ci --no-audit --no-fund` at the repository root.\n\nOne-line reproducer (prints `/workspace/repo/lib/bridge.js`, i.e. a vm2-internal host path):\n\n    node -e \"const {NodeVM}=require('/workspace/repo'); console.log(new NodeVM({require:{builtin:['util']}}).run(\\\"module.exports = require('util').getCallSites(4)[0].scriptName\\\"))\"\n\nObserved frames inside the sandbox, with both `require: { builtin: ['util'] }` and `require: { builtin: ['*'] }`:\n\n    /workspace/repo/lib/bridge.js @apply:1664\n    vm.js @:5\n    /workspace/repo/lib/bridge.js @apply:1664\n    /workspace/repo/lib/nodevm.js @run:563\n    /workspace/out/<embedder entrypoint>.js @main:29\n    node:internal/modules/cjs/loader @:1781\n    node:internal/modules/cjs/loader @:1913\n    ... (8 node:internal/* frames in total)\n\n### Impact\n\nInformation disclosure. Any NodeVM configuration that allows the `util` (or `sys`) builtin — including the wildcard `builtin: ['*']`, both typical configurations from the README — lets untrusted sandboxed code programmatically read the host call stack: the vm2 installation path, the embedding application's file layout and entrypoint, and internal function names and line numbers. This is the same information category redacted by GHSA-v27g-jcqj-v8rw (Defense Invariant #5 in docs/ATTACKS.md) and breaks defense-in-depth assumptions of embedders that rely on host frames being invisible to the sandbox. The API returns only strings/numbers (no host object references); no escalation to code execution was identified.\n\nSuggested fix: filter members in `defaultBuiltinLoaderUtil` (allowlist, or at minimum drop `getCallSites`), apply the same treatment to the generic loader path used by `sys`, and extend the GHSA-v27g regression tests to cover programmatic stack-introspection APIs.","state":0,"publishedAt":"2026-10-05T22:37:40+00:00","modifiedAt":"2026-10-05T22:45:06.5812014+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.11.8"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-r273-hxvj-fxhp","https://nvd.nist.gov/vuln/detail/CVE-2026-92933","https://github.com/patriksimek/vm2/commit/e10bd2f539ab1a90c2d37466e6aae740d4a1ce2a","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/v3.11.8","https://www.vulncheck.com/advisories/vm2-before-3.11.8-information-disclosure-via-util-getcallsites"],"sourceUrl":"https://github.com/advisories/GHSA-r273-hxvj-fxhp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-r273-hxvj-fxhp","identifiers":["GHSA-r273-hxvj-fxhp","CVE-2026-92933"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T16:59:37.9488152+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T16:59:37.9488152+00:00","lastSuccessAt":"2026-11-11T16:59:38.1293575+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:59:38.1293586+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-20b9291a59074a85bd9fdbd9e0ff98a8d24930e69329e59e2815bc7b300e21fc","complete":true,"records":424170,"lastAttemptAt":"2026-11-11T16:57:33.0518174+00:00","lastSuccessAt":"2026-11-11T16:57:32.8751677+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:57:33.0518174+00:00","snapshotPublishedAt":"2026-11-11T16:29:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-cc16d1c02ea6400784671d34434a5b74","complete":false,"records":13759,"lastAttemptAt":"2026-11-11T17:04:12.2465522+00:00","lastSuccessAt":"2026-11-11T17:04:12.3248898+00:00","error":null,"lastVerifiedAt":"2026-11-11T17:04:12.3248898+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T16:59:37.9488152+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T16:59:37.9488152+00:00","lastSuccessAt":"2026-11-11T16:59:38.1301472+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:59:38.1301474+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-9169816ed33d4259981dbb50309d6730","complete":true,"records":13753,"lastAttemptAt":"2026-11-11T16:59:52.0562868+00:00","lastSuccessAt":"2026-11-11T16:59:52.052+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:59:52.052+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T16:59:37.8157847+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:59:37.8157847+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T16:57:33.208402+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:57:33.208402+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-11T16:59:37.9166712+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:59:37.9166712+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-1443070691f712910eadc1ced449c2937aded59c9a578abda33e86dec787c46b","complete":true,"records":231689,"lastAttemptAt":"2026-11-11T16:59:37.6826554+00:00","lastSuccessAt":"2026-11-11T16:59:36.20998+00:00","error":null,"lastVerifiedAt":"2026-11-11T16:59:37.6826554+00:00","snapshotPublishedAt":"2026-11-11T16:33:19+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}