cyfenced.com →

[ CVE-2026-100721 · Published 27 Sep 2026 ]

vm2: NodeVM custom resolution bypasses external path boundaries

CVSS 9.0 EPSS <1%1 agency advisoryFix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)
  • Critical severity: CVSS 9.0

[ Description ]Official description

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.

[ Fixes ]Fixes and patches

  • vm2 3.12.2Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.12.2 or later (affected <= 3.12.1)

[ Advisories ]Government CERT advisories

[ Packages ]Affected open-source packages

[ References ]References