CVE-2026-92933

A flaw was found in vm2. The NodeVM component exposes the host util module, including the util.getCallSites function, to the sandbox as an unfiltered copy. On Node.js versions 22.9 and later, this allows sandboxed code to access util.getCallSites, which can return the host process's full call...