The patriksimek vm2 module for Node.js contains an information disclosure vulnerability in versions before 3.11.0. The CallSite wrapper class, designed to safely wrap V8's native CallSite, blocks certain methods to prevent host object leakage but does not sanitize the output of getFileName(). This allows any code running inside the sandbox to retrieve absolute file paths from the host environment, revealing sensitive information such as directory structures, library locations, and framework versions. The vulnerability is addressed by sanitizing or restricting this information in vm2 version 3.11.0.

An attacker with the ability to execute code inside the vm2 sandbox can obtain sensitive information about the host environment, including full directory structures, library paths, and framework versions. This information disclosure could aid in further attacks or reconnaissance but does not directly allow code execution or data modification outside the sandbox. The CVSS score is 5.8 (medium severity), reflecting the confidentiality impact without integrity or availability impact.

This vulnerability is fixed in vm2 version 3.11.0. Users of vm2 should upgrade to version 3.11.0 or later to remediate this issue. No official patch or workaround is indicated other than upgrading. Patch status is not explicitly stated beyond the fix in 3.11.0, so users should consult the vendor's release notes for confirmation.