Detections
Analytics

SCA: security update for vm2 (GHSA-x6m4-chr9-cg97)

medium Tenable Cloud Security Plugin ID 473032

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error
 stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a
 SyntaxError (for example by calling eval with malformed source) and then read the error's .stack property;
 the bridge forwards the .stack read to the host-realm formatter, bypassing the sandbox-side host-path
 redaction introduced for GHSA-v27g-jcqj-v8rw. The returned stack string discloses absolute paths from vm2,
 Node.js internals, and the embedding application's own source tree, along with host function names.
 Default new VM() and new NodeVM() configurations are affected without any special options, and the issue
 persists when string eval is disabled because the host-side transformer throws before eval is handled. The
 impact is information disclosure only; no code execution results. Fixed in vm2 3.11.7. (CVE-2026-92936)

Solution

Update the vm2 library and its related packages to version 3.11.7 or later.

See Also

https://github.com/advisories/GHSA-x6m4-chr9-cg97

Plugin Details

Severity: Medium

ID: 473032

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/6/2026

Updated: 10/6/2026

Risk Information

VPR

Risk Factor: Low

Score: 1.2

Percentile: 0.01

Vendor

Vendor Severity: Medium

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2026-92936

CVSS v3

Risk Factor: Medium

Base Score: 5.8

Temporal Score: 5.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/5/2026

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-92936