GHSA-5H3F-Q97H-CCVC vm2: NodeVM custom resolution bypasses external path boundaries

Summary At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the...

lib/resolver-compat.js Code Execution

The vulnerability of the LegacyResolver.customResolve function in the lib/resolver-compat.js file of the NodeVM library’s vm2 module is related to authentication process vulnerabilities. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2026-100721 vm2 before 3.12.2 Authorization Bypass via Custom Resolver

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

CVE-2026-100721

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures "require.external" with a custom resolver and "context: 'host'", "LegacyResolver.customResolve" in lib/resolver-compat.js records the resolved module directory in "this.externals...

PT-2026-99448

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.12.2 Description An authorization bypass exists in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', the LegacyResolver.customResolve function ...