vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

Summary NodeVM normalizes node:-prefixed builtin specifiers during require resolution, but it does not normalize user-provided negative builtin entries in wildcard policy. As a result, this configuration: js new NodeVM require: builtin: '', '-node:childprocess' ; does not deny the canonical...

EUVD-2026-81585

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE...

GHSA-8HR7-R645-PC6W vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

NPM: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

NPM: vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE vulnerability discovered by ? in WordPress Npm vm2 versions = 3.11.4, = 3.11.6...

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE

Summary The NodeVM constructor computes hasRealRequireConfig using typeof requireOpts === 'object' && requireOpts !== null, so require: bypasses the guard intended to reject nesting without an explicit require configuration. makeResolverFromLegacyOptions then destructures the array to undefined...

vm2 NodeVM can replace the host process TLS trust store

Summary vm2 3.11.6 exposes the host tls module to a NodeVM when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide tls.setDefaultCACertificates, sandbox code can...

GHSA-98XX-8MX4-X7CM vm2 NodeVM can replace the host process TLS trust store

Summary vm2 3.11.6 exposes the host tls module to a NodeVM when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide tls.setDefaultCACertificates, sandbox code can...

EUVD-2026-81591

vm2 NodeVM can replace the host process TLS trust store...

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Summary isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. nodemodules/foo2 starts with nodemodules/foo, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relati...

GHSA-7Q3F-WX44-378M vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Summary isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. nodemodules/foo2 starts with nodemodules/foo, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relati...

lib/resolver-compat.js Code Execution

The vulnerability of the LegacyResolver.customResolve function in the lib/resolver-compat.js file of the NodeVM library’s vm2 module is related to authentication process vulnerabilities. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

Exploit for CVE-2026-100721

CVE-2026-100721 — vm2 NodeVM external allowlist bypass Python...

Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configure...

GHSA-C9WR-QM7P-P6VC Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-5h3f-q97h-ccvc. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configure...

Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength...

GHSA-43RV-JRFH-9MRR Duplicate Advisory: vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundary

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-489w-w794-jq94. This link is maintained to preserve external references. Original Description vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength...

CVE-2026-100723

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100721

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver and context: 'host', LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new...

CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...

CVE-2026-100723 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant byteOffset === 0 and buffer.byteLength === length to Buffers returned from host builtin modules. When an application explicitly exposes Node's zlib module through NodeVM's builtin allowlist require: builtin: 'zlib' ,...