vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

GHSA-C48M-32M9-VX93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package na...

Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

CVE-2026-92945: Improper Limitation of a Pathname to a Restricted Directory

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...