CVE-2026-100721

Overview

The critical CVE-2026-100721 affects the vm2 sandbox library, allowing an authorization bypass in the NodeVM external-module resolver. By configuring a custom resolver with context set to 'host', an attacker can load non-allowlisted modules that share a path prefix, causing host code execution. This flaw enables arbitrary code execution in the host process.

Description

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.

Impact

The vulnerability compromises confidentiality, integrity, and availability of the host application. Defenders using vm2 in a sandboxed environment risk arbitrary code execution, potentially exposing sensitive data or allowing privilege escalation. The flaw is exploitable by any untrusted guest code that can influence the resolver configuration.

Remediation

Upgrade vm2 to version 3.12.2 or later where the external-module resolver has been fixed. If upgrading is not immediately possible, disable external module resolution by setting `require.external` to false or use a strict resolver that enforces full path matching. Additionally, run the sandbox with the least privileged user and monitor for unexpected module loads.

Risk context

Severity is critical with a CVSS v3 score of 9.0 and a CVSS v4 score of 9.5. The EPSS score of 0.004 indicates a low probability of exploitation in the wild, but the high severity warrants prompt patching.

Affected products

• vm2 3.12.2-
• NodeVM