CVE-2026-100721 Details

A vulnerability exists in vm2 versions prior to 3.12.2, allowing for an authorization bypass in the NodeVM external-module resolver. When an embedder sets 'require.external' with a custom resolver and 'context: host', the 'LegacyResolver.customResolve' function records the resolved module directory in 'this.externals' as a regular expression matching the start of the path. This implementation lacks necessary path boundaries, enabling untrusted guest code to require an allowlisted module and then access a non-allowlisted sibling module that shares the same path prefix. The sibling module can then be loaded through 'hostRequire', executing its code in the host process and escaping the sandbox, leading to arbitrary code execution in the host context.

Users can upgrade to vm2 version 3.12.2 or later, where this vulnerability has been patched. The patch involves updating the 'LegacyResolver' to require a path boundary after the module name, preventing the unintentional loading of sibling modules that could escape the sandbox.