AIKIDO-2026-918905
vm2 is vulnerable to Information Disclosure
58
Medium Risk
This Affects:
vm2TL;DR
The sandbox exposes the host util module by shallow-copying all of its members instead of using a vetted allowlist. Newly added Node APIs, including call-stack introspection helpers, become reachable from sandboxed code automatically. Sandboxed code reads the host call stack and learns the installation path, embedding application file layout, function names, and line numbers that host-frame redaction is meant to hide. The fix replaces the wholesale copy with an explicit allowlist of safe util members.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run on Node.js 22.9 or newer with the util builtin exposed to the sandbox.
Background info
vm2 is vulnerable to Information Disclosure in versions 0.0.1 - 3.11.7.
How to fix this
Upgrade the vm2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.