vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling eval with malformed source) and then read the error's .stack property; the bridge forwards the .stack read to the host-realm formatter, bypassing the sandbox-side host-path redaction introduced for GHSA-v27g-jcqj-v8rw. The returned stack string discloses absolute paths from vm2, Node.js internals, and the embedding application's own source tree, along with host function names. Default new VM() and new NodeVM() configurations are affected without any special options, and the issue persists when string eval is disabled because the host-side transformer throws before eval is handled. The impact is information disclosure only; no code execution results. Fixed in vm2 3.11.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error
    stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a
    SyntaxError (for example by calling eval with malformed source) and then read the error's .stack property;
    the bridge forwards the .stack read to the host-realm formatter, bypassing the sandbox-side host-path
    redaction introduced for GHSA-v27g-jcqj-v8rw. The returned stack string discloses absolute paths from vm2,
    Node.js internals, and the embedding application's own source tree, along with host function names.
    Default new VM() and new NodeVM() configurations are affected without any special options, and the issue
    persists when string eval is disabled because the host-side transformer throws before eval is handled. The
    impact is information disclosure only; no code execution results. Fixed in vm2 3.11.7. (CVE-2026-92936)

ID	Name	Product	Family	Type	Severity
473580	Echo: vm2: security update to 3.11.7	Tenable Cloud Security	Echo Local Security Checks	Local	medium
473580	Echo: vm2: security update to 3.11.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
473032	SCA: security update for vm2 (GHSA-x6m4-chr9-cg97)	Tenable Cloud Security	SCA Checks	Local	medium
473032	SCA: security update for vm2 (GHSA-x6m4-chr9-cg97)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-92936

medium

Tenable Plugins

medium

medium

medium

medium