EUVD-2026-81595

vm2: NodeVM require.external without an explicit require.root grants unrestricted host filesystem access and full RCE...

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

NPM: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

NPM: vm2: NodeVM require.external without an explicit require.root grants unrestricted host filesystem access and full RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

GHSA-J3HM-6RG5-MCHV vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Summary NodeVM's require.external option lets sandboxed code require local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes nodemodules, two defaults combine to fully defeat the sandbox: - require.root defaults to unrestricted...

GHSA-QHWX-74W5-XHXQ vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

Summary On Node.js 24 and newer, vm2 can expose the host node:test module to sandboxed NodeVM code when the embedder explicitly allows the node:test builtin. Sandbox code can reach that module through require'node:node:test' and call run with attacker-controlled execArgv. node:test.run starts a...

NPM: vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape

NPM: vm2: NodeVM builtin allowlist bypass via node:test.run execArgv allows sandbox escape vulnerability discovered by ? in WordPress Npm vm2 versions = 3.9.6, = 3.11.6...

vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scripts

Summary The vm2 command-line tool installed by npm install -g vm2 and documented in the README's "CLI" section runs the supplied script under NodeVM with require:external:true and no root / context / builtin configured. With these defaults the resolver loads every relative or absolute require...

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

EUVD-2026-81590

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent...

GHSA-H85J-HV3C-QFGQ vm2 exposes host HTTPS credentials and TLS traffic through globalAgent

Summary vm2 3.11.6 exposes the host process's real https.globalAgent when a NodeVM is explicitly allowed to require https. The module is wrapped as read-only, but calls to methods on the shared agent still mutate the host object. Sandbox code can register a free listener and receive host request...

GHSA-C48M-32M9-VX93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

EUVD-2026-81607

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes...

GHSA-6RH5-QQ4Q-97XH vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

Summary NodeVM's builtin wildcard policy can allow sandboxed code to access fs/promises even when the embedder denies fs. With the following configuration: js require: builtin: '', '-fs', '-childprocess' require'fs' and require'childprocess' are blocked, but require'fs/promises' and...

NPM: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

NPM: vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

NPM: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

NPM: vm2: NodeVM node:-prefixed negative builtin deny bypass exposes childprocess vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.6...

GHSA-8686-VHFX-7R3J vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

EUVD-2026-81606

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes childprocess...

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...