CVE-2026-44002

5.8 Moyenne

Publiée le 13/05/2026 à 20:16 · Modifiée le 17/06/2026 à 12:50 · Analysée par le NVD · Source : security-advisories@github.com

Description

vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.0, vm2's CallSite wrapper class (intended as a safe wrapper for V8's native CallSite) blocks getThis() and getFunction() to prevent host object leakage, but allows getFileName() to return unsanitized host absolute paths. Any sandboxed code can extract the full directory structure, library paths, and framework versions of the host server. This vulnerability is fixed in 3.11.0.

Traduire en français

Produits concernés

patriksimek vm2
Vm2 project vm2

Scores CVSS

Version	Score	Source	Vecteur
3.1	5.8 Moyenne	security-advisories@github.com	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N`

Faiblesses (CWE)

CWE-209

Références

https://github.com/patriksimek/vm2/security/advisories/GHSA-v27g-jcqj-v8rw ExploitVendor Advisory

Ailleurs

NVD
CVE.org
CIRCL Vulnerability-Lookup
CERT-FR
GitHub Advisories