Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.5
vm2 allows untrusted code to break out of sandbox
published 22 days ago
Summary
The vm2 library used in GitHub Actions can let untrusted code slip past its safety checks and run directly on the host system. This could let an attacker execute any code they want on your server. Update vm2 to version 3.12.2 or later and review any configurations that expose the custom module resolver to untrusted code.
What to do
- Update GitHub Actions vm2 to version 3.12.2.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| npm | GitHub Actions | vm2 |
< 3.12.2 Fix: upgrade to 3.12.2
|
Original advisory text
Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries
## Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references.
## Original Description
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.
This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references.
## Original Description
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.
References
- https://github.com/patriksimek/vm2/security/advisories/GHSA-5h3f-q97h-ccvc
- https://nvd.nist.gov/vuln/detail/CVE-2026-100721
- https://github.com/patriksimek/vm2/commit/6ac3916da84e060c403e407b6b6318fcc66b0e...
- https://github.com/patriksimek/vm2/commit/91034466bfb7f56b95fd48083ec6ca36d058f1...
- https://github.com/patriksimek/vm2/commit/ab4ee7d803e8c80155e9eb3672226bddbca4aa...
- https://www.vulncheck.com/advisories/vm2-before-3.12.2-authorization-bypass-via-...
- https://github.com/advisories/GHSA-c9wr-qm7p-p6vc
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit (estimated)
- Gives an attacker full control (estimated)
Type
CWE-863Incorrect Authorization
Timeline
Published27 Sep 2026
Updated6 Oct 2026
First seen6 Oct 2026
Sources
GHSA-c9wr-qm7p-p6vc · GHSA
Track software like this
Free during beta