CVE-2026-100721

The vm2 library (versions before 3.12.2 ) contains an authorization bypass in the NodeVM external-module resolver. When an embedder uses a custom resolver with context: 'host', the LegacyResolver.customResolve function in lib/resolver-compat.js fails to include a path separator or end-of-string b...