EUVD-2026-87858

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...