GHSA-X6M4-CHR9-CG97 vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Summary Attacker-controlled code can trigger a host-realm syntax error and read its stack through the vm2 bridge. Host-realm stack formatting bypasses the sandbox-side redaction, so the returned value exposes absolute paths from vm2, Node.js internals, and the embedding application. Default VM an...

EUVD-2026-81586

vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting...

NPM: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

NPM: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.0, = 3.11.6...

vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Summary Attacker-controlled code can trigger a host-realm syntax error and read its stack through the vm2 bridge. Host-realm stack formatting bypasses the sandbox-side redaction, so the returned value exposes absolute paths from vm2, Node.js internals, and the embedding application. Default VM an...

Information Exposure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the error stack formatting process. An attacker can obtain absolute host filesystem paths, including those from Node.js...

Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6m4-chr9-cg97. This link is maintained to preserve external references. Original Description vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack...

GHSA-63M2-QQCH-JXV2 Duplicate Advisory: vm2 leaks absolute host filesystem paths to sandbox code via error stack formatting

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-x6m4-chr9-cg97. This link is maintained to preserve external references. Original Description vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92936 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError for example by calling eval with malformed source and then read the error's .stack...

CVE-2026-92936

vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting . Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (e.g., via eval with malformed source) and then read the error's .stack property; the...

PT-2026-94308

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.0 through 3.11.6 Description Absolute host filesystem paths are leaked to sandboxed code via error stack formatting. An attacker can force the host-realm source transformer to throw a SyntaxError by calling eval with malforme...

CVE-2026-76210 phpMyFAQ before v4.1.6 Local File Disclosure via PDF Export

phpMyFAQ before 4.1.6 does not adequately sanitize HTML in FAQ answers before generating PDFs via TCPDF. An attacker with permission to create or edit FAQ content can embed an tag whose src references a local file under the web root's content/ directory e.g., content/core/config/database.php. Whe...

CVE-2026-56139

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls what is returned to the client when a route processing error occurs. This option defaulted to false,...

PT-2026-55907

Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.0.0 through 4.14.7 Apache Camel versions 4.15.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.9 Description The camel-netty-http server consumer in Apache Camel contains an issue where the muteException optio...

akt (>=0.1.1, <=0.1.2), bigerror (>=0.1.0, <=0.8.2) +43 more potentially affected by unknown CVE via error-stack (>=0.1.1, <=0.7.1)

error-stack CARGO version =0.1.1, =0.1.1, =0.1.0, =0.6.0, =0.1.0, =0.1.2 - error-path 0.1.0 - error-stack-derive 0.1.0 - error-stack-macros 0.0.0-reserved - error-stack-macros2 0.0.0-reserved - hass-mqtt-discovery 0.2.0 - hyperlit-backend 0.1.0 - hyperlit-base 0.1.0 - hyperlit-database 0.1.0 -...

Improper Validation of Array Index

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Improper Validation of Array Index through the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js. An attacker can observe or rewrite...

vm2 setup-sandbox.js violates Defense Invariant #11 in stack-trace formatter

Summary defaultSandboxPrepareStackTrace in lib/setup-sandbox.js lines 605, 607 appends to a fresh sandbox-realm lines = via lineslines.length = value. This is the exact invariant-violating pattern that GHSA-9qj6-qjgg-37qq commit ca195f0, 2026-05-01 just patched in neutralizeArraySpeciesBatch and...

Information Exposure

Overview vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the sandbox CallSite handling. An attacker can leak absolute host filesystem paths by causing error.stack or getEvalOrigin t...

Information Exposure

Overview org.webjars.npm:vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules. Affected versions of this package are vulnerable to Information Exposure via the sandbox CallSite handling. An attacker can leak absolute host filesystem paths by causing error.stack or...