CVE-2026-100721

Description

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.

CVSS 3.1 breakdown

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

• https://github.com/patriksimek/vm2/commit/6ac3916da84e060c403e407b6b6318fcc66b0e72
• https://github.com/patriksimek/vm2/commit/91034466bfb7f56b95fd48083ec6ca36d058f164
• https://github.com/patriksimek/vm2/commit/ab4ee7d803e8c80155e9eb3672226bddbca4aa9c
• https://github.com/patriksimek/vm2/security/advisories/GHSA-5h3f-q97h-ccvc
• https://www.vulncheck.com/advisories/vm2-before-3.12.2-authorization-bypass-via-custom-resolver

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked