CVE-2026-100721: vm2 Critical Authorization Bypass Vulnerability

Background

vm2 is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run potentially unsafe code in a controlled manner, isolating it from the host environment. This is particularly useful for applications that need to execute user-generated scripts while maintaining security. However, a critical vulnerability has been identified in version 3.11.8, which could allow an attacker to bypass security measures and execute unauthorized code in the host context.

Vulnerability Detail

The vulnerability arises from a flaw in the custom module resolution process within the NodeVM environment of vm2. An untrusted guest can exploit this flaw to gain access to files that share a common prefix with allowlisted modules, effectively bypassing the intended security boundaries. This can lead to unauthorized code execution in the host environment, compromising the confidentiality, integrity, and availability of the system. The vulnerability is classified as CWE-863 (Incorrect Authorization) and has a CVSS score of 10.0, indicating a critical severity level.

npm install vm2@3.12.2

Workaround

If immediate updating is not feasible, consider implementing a custom resolver that strictly checks for exact matches or requires a path separator before allowing access to any sibling modules. Here is an example of a custom resolver function:

const customResolver = (moduleName) => {
    if (moduleName === 'foo') {
        return '/path/to/foo'; // Allowlisted module
    }
    return undefined; // Deny access to other modules
};

Conclusion

The vm2 package has a critical vulnerability that allows for authorization bypass, potentially leading to unauthorized code execution in the host environment. It is crucial for developers using this package to update to the latest version to mitigate the risk. Implementing strict custom resolvers can also help in managing security until an update can be applied.

See every vulnerability recorded for vm2 →

FAQ