CVE-2026-92933 patriksimek CVE debrief

Who should care

Defenders responsible for Node.js environments using vm2, especially those with untrusted code execution, should assess exposure and verify if the vm2 version is 3.11.8 or later. They should prioritize verifying exposure and upgrading to vm2 3.11.8 or later to prevent potential misuse of the stack-introspection API in Node.js >= 22.9 environments. This includes reviewing compensating controls and monitoring for potential stack-introspection API misuse.

Why it matters

Defenders should prioritize verifying exposure and upgrading to vm2 3.11.8 or later to prevent potential misuse of the stack-introspection API in Node.js >= 22.9 environments.

• Potential exposure of sensitive host process information
• Possible misuse of stack-introspection API
• Verification of vm2 version and Node.js environment required
• Potential impact on applications using vm2 for untrusted code execution

Technical summary

vm2 versions <= 3.11.7 expose the host `util` module to the sandbox as an unfiltered shallow copy, allowing sandboxed code to access `util.getCallSites()` on Node.js >= 22.9. This API returns the host process's full call stack, including absolute file paths, function names, and line numbers. The issue is fixed in vm2 3.11.8. Defenders should prioritize verifying exposure and upgrading to vm2 3.11.8 or later to prevent potential misuse of the stack-introspection API in Node.js >= 22.9 environments. The vulnerability allows sandboxed code to access sensitive host process information.

Defensive priority

Defenders should prioritize verifying exposure and upgrading to vm2 3.11.8 or later.

Recommended defensive actions

• Verify if the vm2 version is 3.11.8 or later
• Assess exposure in Node.js >= 22.9 environments
• Monitor for potential stack-introspection API misuse
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but its impact and affected versions require verification. The issue allows sandboxed code to access the host process's full call stack on Node.js >= 22.9 through `util.getCallSites()`. Verification of vm2 version and Node.js environment is required. The CVE record was published on 2026-09-17T14:17:57.337Z and has not been modified since then. The NVD entry is currently Deferred.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.