What is the CVSS score of CVE-2026-44002?

CVE-2026-44002 has a CVSS 3.1 base score of 5.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44002?

Yes, a patch is available for CVE-2026-44002. Update the affected software to the latest version immediately.

vm2 CVE-2026-44002

MEDIUM

Error Message Information Leak (CWE-209)

2026-05-07 https://github.com/patriksimek/vm2

GHSA-v27g-jcqj-v8rw

Information Disclosure Node.js

5.8

CVSS 3.1 · Vendor: https://github.com/patriksimek/vm2

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Supply JavaScript code to sandbox
Delivery

Trigger error or set prepareStackTrace
Exploit

Call getFileName on CallSite objects
Execution

Extract host absolute paths
Impact

Map architecture and dependencies

Vulnerability Assessment

Weakness	CWE CWE-209 OWASP Top 10:2025 A10:2025 - Mishandling of Exceptional Conditions ASVS 5.0 V16 - Security Logging and Error Handling Error message sanitization MITRE ATT&CK 1 technique across 1 tactic: Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	No special conditions are required. Sandboxed code can unconditionally trigger error generation or modify Error.prepareStackTrace without any host configuration changes, non-default setup, or authentication. The vulnerability exists in all standard vm2 deployments because the VM class exposes error-handling and Error.prepareStackTrace as standard JavaScript APIs that cannot be disabled from within the sandbox. The only limiting factor is that the attacker must be able to supply arbitrary JavaScript code to the sandboxed execution environment-this is the threat model that vm2 is designed to address, so exploitation is automatic for any application passing untrusted user input to VM.run().
Impact	CVSS 5.8 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) correctly reflects network-accessible remote exploitation with no authentication and low complexity. However, the real-world impact is asymmetric: while information disclosure alone does not achieve remote code execution, the leaked paths become reconnaissance data for chaining with other sandbox-escape vulnerabilities (as evidenced by the v3.11.0 release notes citing 13 coordinated advisories including multiple RCE primitives). Exploitation is highly reliable-triggering an error or setting prepareStackTrace are trivial from sandboxed code with no special conditions. EPSS score not provided in input data. KEV status unknown at analysis time. The confidentiality impact is limited to path and function name leakage (not code content or secrets), but the utility as attack staging data is significant in contexts where vm2 runs truly adversarial untrusted code. In contrast, applications using vm2 only to isolate semi-trusted internal tools or restricted APIs may find this a lower-priority finding. The patch availability (v3.11.0) and low exploitation complexity strongly argue for immediate patching in production sandboxes.
Exploit ScenarioDerived	An attacker supplies malicious JavaScript to a web application that executes user-provided code in a vm2 sandbox (e.g., a code-execution-as-a-service platform, CI/CD runner, or educational code evaluator). Within the sandbox, the attacker triggers an error with new Error().stack or sets Error.prepareStackTrace to enumerate all host file paths in a single request. The attacker extracts paths like /app/node_modules/vm2/lib/vm.js, /app/src/server.js, and /opt/dependencies/express/index.js, revealing the host architecture, framework stack, and internal module layout. This reconnaissance is then used to target specific sandbox-escape vulnerabilities identified from the leaked function names or library versions.

This Month Plan within 30 days. Why: MEDIUM severity (CVSS 4.0-6.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 07, 2026

Information disclosure in vm2 allows sandboxed code to extract host absolute file paths, library locations, and internal function names via stack trace inspection, enabling attackers to map the host server's directory structure and architecture without authentication or user interaction. The vulnerability affects all versions up to 3.10.5 and is triggered through either default error.stack formatting or custom Error.prepareStackTrace handlers; vendor-released patch available in version 3.11.0.

RemediationAI

Upgrade vm2 to version 3.11.0 or later immediately. The upstream fix sanitizes CallSite wrapper methods to prevent path disclosure while maintaining sandbox isolation. No workarounds are recommended for production environments running untrusted code, as error handling and stack trace inspection are fundamental JavaScript features that cannot be reliably disabled from the sandbox boundary. Organizations unable to upgrade should implement network-level segmentation to restrict outbound connections from sandboxed execution contexts and monitor error logs for suspicious stack trace extraction patterns, though these are compensating controls with significant operational overhead and should not delay patching.

Affected Packages

npm vm2 fix: 3.11.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

vm2 is a Node.js sandbox library that restricts code execution by wrapping host V8 CallSite objects (which represent stack frames). The wrapper class in lib/setup-sandbox.js blocks getThis() and getFunction() to prevent host object leakage, but fails to sanitize getFileName(), getLineNumber(), getColumnNumber(), getFunctionName(), getMethodName(), and getTypeName() methods. These methods return unfiltered host runtime data including absolute filesystem paths. The root cause (CWE-209: Information Exposure Through an Error Message) stems from incomplete sanitization of a security wrapper-the developers blocked direct object reference leakage but left metadata paths unsanitized. CPE pkg:npm/vm2 <= 3.10.5 is affected. Two distinct exploitation paths exist: passive observation of default error.stack formatting which includes host frames, or active manipulation via Error.prepareStackTrace to directly enumerate all host file paths without triggering exceptions.

Know when Node.js gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/patriksimek/vm2) PRIMARY 5.8 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Red Hat 5.8 MEDIUM

Primary rating from Vendor (https://github.com/patriksimek/vm2).

CVSS VectorVendor: https://github.com/patriksimek/vm2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

None

Availability

None

DescriptionCVE.org

Summary

vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server.

Details

In lib/setup-sandbox.js:436-466, the CallSite class overrides getThis() and getFunction() with undefined to prevent host object references from leaking into the sandbox. However, the following methods pass through unsanitized values from the original V8 CallSite object:

getFileName() - returns host absolute paths like /app/node_modules/vm2/lib/vm.js
getLineNumber(), getColumnNumber() - exact source locations
getFunctionName(), getMethodName(), getTypeName() - internal function names

Two exploitation paths exist:

Default error.stack: new Error().stack includes host frame paths in the formatted string
Custom prepareStackTrace: Attacker can set Error.prepareStackTrace to directly call getFileName() on each CallSite, extracting a clean list of all host paths

PoC

Library-level PoC (Node.js script - primary):

javascript

const { VM } = require("vm2");
const vm = new VM();

// Path A - Default error.stack
const result1 = vm.run(`try { null.x; } catch(e) { e.stack }`);
console.log(result1);
// Output includes: /app/node_modules/vm2/lib/vm.js:289:18
//                   /app/src/server.js:49:20

// Path B - prepareStackTrace extraction
const result2 = vm.run(`
  Error.prepareStackTrace = function(e, sst) {
    return sst.map(function(s) { return s.getFileName(); }).join(", ");
  };
  new Error().stack
`);
console.log(result2);
// Output: vm.js, node:vm, /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, ...

HTTP demonstration:

bash

# Default error.stack
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"try { null.x; } catch(e) { e.stack }"}'
# Result includes host paths: /app/src/server.js, /app/node_modules/express/...
# prepareStackTrace extraction
curl -s -X POST http://localhost:3000/api/execute \
  -H "Content-Type: application/json" \
  -d '{"code":"Error.prepareStackTrace = function(e, sst) { return sst.map(function(s) { return s.getFileName(); }).join(\", \"); }; new Error().stack"}'
# Result: /app/node_modules/vm2/lib/vm.js, /app/src/sandbox.js, /app/src/server.js, ...

Impact

Information Disclosure: Host directory structure, library paths, framework versions, and internal architecture are exposed to sandboxed code.
Attack Chain: Leaked paths enable precise targeting for other vulnerabilities.
Scope: All applications using vm2. No special configuration required.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Threat Intel

1 source

Data Quality

6 sources

Confidence: High

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity MEDIUM

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

MEDIUM severity (CVSS 4.0-6.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived

Scheduled

Exploitation

Poc

System Exposure· derived

Open

Automatable

Yes

Human Impact· derived

Medium

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +29

PoC: 0

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.