AIKIDO-2026-10726
vm2 is vulnerable to Information Disclosure
58
Medium Risk
This Affects:
vm2TL;DR
prepareStackTrace integration can surface host CallSite metadata that includes filesystem paths and other host layout signals. Untrusted guest code learns sensitive information about the deployment environment. The impact is information disclosure rather than immediate code execution. Stack trace handling is adjusted to avoid leaking host file paths through this channel.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
vm2 is vulnerable to Information Disclosure in versions 0.0.1 - 3.10.5.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant