The vm2 Node.js sandbox prior to version 3.11.0 contains an information disclosure vulnerability where its CallSite wrapper class, designed to safely wrap V8's native CallSite, blocks certain methods to prevent host object leakage but permits getFileName() to return unsanitized absolute paths. This allows any code running inside the sandbox to extract sensitive host environment details such as directory structures, library locations, and framework versions. This vulnerability is tracked as CVE-2026-44002 and classified under CWE-209. The issue is resolved in vm2 version 3.11.0.

Exploitation of this vulnerability allows sandboxed code to access sensitive information about the host system's directory structure, library paths, and framework versions. This information disclosure could aid an attacker in further reconnaissance or targeted attacks. There is no direct impact on integrity or availability. The CVSS 3.1 base score is 5.8 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact.

Upgrade vm2 to version 3.11.0 or later, where this vulnerability is fixed. Since the vendor advisory indicates the issue is resolved in 3.11.0, applying this official fix is the recommended remediation. No other mitigation steps are specified or required.