vm2 CVE-2026-92933

Two concrete prerequisites must both hold: (1) the host application must run attacker-controlled JavaScript inside vm2's NodeVM - the vulnerable util module is exposed by the DEFAULT builtin loader (defaultBuiltinLoaderUtil via Object.assign({}, util)) plus the deprecated sys alias, so no unusual builtin/denylist configuration is required; and (2) the host must be on Node.js >= 22.9, the version that introduced the util.getCallSites() stack-introspection API the exploit depends on. On Node.js < 22.9 the API is absent and the flaw is not exploitable. Impact is limited to disclosure of host stack metadata (absolute file paths, function names, line numbers) and does not by itself grant code execution or write access. This channel specifically bypasses the host-frame redaction added for GHSA-v27g-jcqj-v8rw, which only covered the Error.prepareStackTrace formatting path.

This is a genuine but low-to-moderate priority information-disclosure flaw, correctly rated below the RCE-class vm2 escapes. The vendor CVSS 4.0 6.9 vector (AV:N/AC:L/PR:N/UI:N) with VC:L and SC:L accurately reflects a low-confidentiality leak that crosses the sandbox boundary (subsequent-system impact) but causes no integrity (VI:N) or availability (VA:N) damage - consistent with CWE-200. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or imminent exploitation; treat exploitation status as 'no public exploit identified at time of analysis.' The PR:N rating is meaningful only inside the vm2 threat model: the 'attacker' is the untrusted JavaScript the host application already chose to run in the sandbox, so 'unauthenticated' here means 'the sandboxed code itself,' not an anonymous network peer. Two real limiters cut against the raw score: exploitation requires Node.js >= 22.9 (for the util.getCallSites() API) and requires the application to actually execute attacker-controlled code in NodeVM. Impact is bounded - leaking host file paths, function names, and line numbers is reconnaissance that aids chaining to a heavier vm2 escape, not a standalone breach. No conflicting signals across sources; the description, CVSS 4.0 vector, and CWE-200 all agree on scope and impact.

An application runs untrusted user-supplied JavaScript inside vm2's NodeVM on Node.js 22.9+. The sandboxed code calls util.getCallSites() (or the sys alias) and reads back the host process's full call stack - absolute filesystem paths, internal function names, and line numbers for both vm2's bridge internals and the embedding application's entrypoint. The attacker uses this leaked layout to map the host environment and prepare a follow-on sandbox-escape exploit. No public POC is referenced, and exploitation is trivial once untrusted code executes (AC:L, no user interaction).