5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44002

CVE-2026-44002: vm2: Host File Path Disclosure via Stack Trace Information Leak

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44002

CVE-2026-44002:

5.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
vm2	npm	<= 3.10.5	3.11.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-v27g-jcqj-v8rw, is an information disclosure flaw in vm2 where sandboxed code can obtain absolute file paths from the host machine. This is caused by insufficient sanitization in the CallSite wrapper class, which is meant to provide a safe version of V8's native stack frame objects.

There are two primary ways to exploit this:

Path A (Default error.stack): By default, if Error.prepareStackTrace is not set, V8 uses a native formatter that includes full file paths in the error.stack string. The initial state of vm2's sandbox allowed this native formatter to be used, leaking host paths.
Path B (Custom prepareStackTrace): An attacker can define a custom Error.prepareStackTrace function. This function receives an array of CallSite objects. The vulnerability lies in the fact that methods on vm2's wrapped CallSite objects, such as getFileName(), getLineNumber(), and getEvalOrigin(), would return unsanitized data for stack frames originating from the host.

The analysis of the patches between the vulnerable version (3.10.5) and the fixed version (3.11.0) confirms this. The commit e5d8635f6cc3516b0fb0cd346f9ca33303fa953c fixes Path B by modifying the applyCallSiteGetters function in lib/setup-sandbox.js. It introduces logic to detect if a stack frame belongs to the host and, if so, redacts the output of all CallSite getters by returning null. The subsequent commit, 0a394d33fac1364d64fd790b0f0ddeaa4067afa1, further hardens this by unconditionally redacting getEvalOrigin() and fixing Path A by ensuring a safe, sandboxed prepareStackTrace function is set by default.

The identified vulnerable functions are applyCallSiteGetters, which contained the flawed logic, and the CallSite getters (getFileName, getEvalOrigin) that the attacker's code would call to retrieve the sensitive information.

Vulnerable functions

applyCallSiteGetters

lib/setup-sandbox.js

This function is responsible for applying getter methods to the `CallSite` wrapper object. The original implementation directly copied the output of the underlying V8 `CallSite` object's methods without sanitization. This allowed sensitive information, such as host file paths from `getFileName()`, to be exposed to the sandboxed code. The patch modifies this function to first classify if a stack frame is from the host and, if so, returns `null` for all getters, effectively redacting the sensitive information.

CallSite.getFileName

lib/setup-sandbox.js

This getter method on the `CallSite` wrapper object was the primary vector for the information disclosure. When called on a stack frame originating from the host environment, it would return the full, unsanitized absolute file path. An attacker could abuse this by providing a custom `Error.prepareStackTrace` function that iterates through the stack frames and collects these paths.

CallSite.getEvalOrigin

lib/setup-sandbox.js

Similar to `getFileName`, this getter method was found to leak host path information. The string returned by `getEvalOrigin` could contain an embedded host file path if an `eval` was triggered from host code. The patch explicitly redacts the output of this getter for all frames to prevent this leak.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.