Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.5

vm2 NodeVM may load unauthorized files

CVE-2026-100721 · published 13 days ago
Summary

The vm2 library version before 3.12.2 lets code inside a sandbox load files it shouldn’t be able to. An attacker can trick the sandbox into running code from a nearby module, which can then execute commands on the host system. Update vm2 to the latest version or apply the provided patch to stop this behavior.

What to do
  • Update vm2 to version 3.12.2.
  • Update patriksimek vm2 to version 3.12.2 or later.
Affected software
Ecosystem VendorProductAffected versions
– patriksimek vm2 < 3.12.2
npm – vm2 <= 3.12.1
< 3.12.2
Fix: upgrade to 3.12.2
Original advisory text
vm2: NodeVM custom resolution bypasses external path boundaries
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker full control
Severity
9.5 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-863Incorrect Authorization
Timeline
Published27 Sep 2026
Updated9 Oct 2026
First seen27 Sep 2026
Sources
CVE-2026-100721 · NVD
CVE-2026-100721 · MITRE
CVE-2026-100721 · OSV
GHSA-5h3f-q97h-ccvc · GHSA
GHSA-5h3f-q97h-ccvc · OSV
Track software like this
Free during beta