CVE-2026-100721
Deferred Deferred - Pending Action

Authorization Bypass in vm2 NodeVM External Module Resolver

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: VulnCheck

Description
vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100721
EUVD
EUVD-2026-87858

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
vm2 vm2 to 3.12.2 (exc)
patriksimek vm2 to 3.12.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in vm2 before 3.12.2 allows untrusted guest code to bypass module allowlisting when a custom resolver with context set to 'host' is configured. The issue occurs because the resolver records resolved module paths as regular expressions without proper path boundary checks. Attackers can require an allowlisted module and then load a non-allowlisted sibling module whose path shares the same prefix, leading to arbitrary code execution in the host process.

Detection Guidance

To detect this vulnerability, check if your system is running vm2 versions prior to 3.12.2. Run: npm list vm2 or node -e "console.log(require('vm2/package.json').version)". If the version is below 3.12.2, the system is vulnerable.

Impact Analysis

This vulnerability enables attackers to execute arbitrary code in the host process by bypassing the sandbox. If you use vm2 with a custom resolver and context set to 'host', an attacker controlling guest code could run malicious commands, access sensitive data, or take control of your system. The impact includes full host process compromise and potential data breaches.

Compliance Impact

This vulnerability can lead to unauthorized code execution and data access, violating compliance requirements for GDPR (data protection), HIPAA (health information security), and other regulations. It may result in data breaches, unauthorized access to sensitive information, and failure to maintain system integrity, potentially leading to legal penalties and reputational damage.

Mitigation Strategies

Immediately update vm2 to version 3.12.2 or later. If updating is not possible, disable the use of custom resolvers with context set to 'host' and avoid allowing external modules in NodeVM configurations.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100721. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart