CVE catalog

CVE-2026-44002

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host obj

[CVE catalog]

Severity
Medium · CVSS 5.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.24% · Oct 25, 2026

A flaw was found in vm2 (before 3.11.0). The CallSite wrapper blocks getThis() and getFunction() but returns unsanitized host absolute paths from getFileName(), allowing sandboxed code to learn host directory layout, library paths, and framework versions. Fixed in 3.11.0. vm2: vm2: Information disclosure through unsanitized host paths vm2 is vulnerable to information disclosure via unsanitized host file paths returned by CallSite.getFileName(). A remote unauthenticated attacker who can run sandboxed code may extract host filesystem layout and version information. Fixed in vm2 3.11.0. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Cpevm2Not reported3.11.0fixed
Cpevm2Not reported3.11.0fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Cpevm2cpeNot reported3.11.0Not reportedNot reportedNot reported
Cpevm2cpeNot reported3.11.0Not reportedNVD-CVE-2026-44002Not reported

OpenFactory catalog packages

No matching packages in this catalog.

Observed:

References

[CERT-Bund public advisories] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [Red Hat security advisories and VEX]