vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

Source published

17 Sep 2026 13:46:10 UTC

Source modified

17 Sep 2026 19:20:34 UTC

Observed here

23 Oct 2026 15:48:27 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CVSS 3.1 · 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

Source published

Sep 17, 2026, 1:46:10 PM (timezone not stated)

Source modified

Sep 17, 2026, 7:20:34 PM (timezone not stated)

Observed here

11 Nov 2026 17:05:16 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

Source published

17 Sep 2026 14:18:00 UTC

Source modified

17 Sep 2026 20:18:59 UTC

Observed here

25 Oct 2026 16:19:22 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 9.4 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS 3.1 · [email protected] · Secondary · 9.9 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

## Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-c48m-32m9-vx93. This link is maintained to preserve external references. ## Original Description vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

Source published

17 Sep 2026 15:32:16 UTC

Source modified

1 Oct 2026 15:45:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Publisher rating · CRITICAL

### Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When `NodeVM` enables an `external` allowlist together with a custom `resolve` callback, vm2 checks the requested package name with a non-exact match. For example, if the allowlist only permits `left-pad`, an attacker can still bypass the check with a colliding package name such as `evil-left-pad`, because it contains the allowlisted name. If the colliding package already exists in a host path resolvable by the custom resolver, or if the target application's custom resolver / dependency-management workflow downloads the package and places it in a resolvable path, vm2 loads and executes that package in the host context. This lets sandboxed code bypass the module allowlist and may further lead to host code execution. ### Details `NodeVM` supports `require.external` to configure which external npm packages sandboxed code may load. It also supports a custom resolver through `require.resolve`. This combination is commonly used in business plugin systems, user-script platforms, or sandbox execution environments: the application allows only a small set of trusted dependencies while using a custom resolver that points to the application's own package directory. The vulnerability is in the allowlist pre-check logic before the custom resolver is called. vm2 generates a regular expression from the `external` allowlist and uses it to check the original package name supplied by sandboxed code. However, the regular expression is not anchored to the full package-name boundary, so it performs a substring match on the original package name. For example, with the following configuration: ```js new NodeVM({ require: { external: ['left-pad'], resolve: id => require.resolve(id, { paths: [customRoot] }), context: 'host', builtin: [] } }) ``` The intended policy is that sandboxed code can only load `left-pad`. However, because vm2 uses a non-exact match similar to `/left\-pad/` for the requested package name, names such as `evil-left-pad` and `left-pad-backdoor` also pass the allowlist pre-check. After `evil-left-pad` passes the check, vm2 calls the custom resolver configured by the application. If the resolver can find that colliding package in a host-resolvable path, vm2 adds the returned path to the loadable list and, in `context: 'host'` mode, loads the package with the host `require()`. At that point, the package's top-level code executes in the host context instead of being constrained by sandbox restrictions such as `NodeVM`'s `builtin: []`. In local verification, the PoC only allows `external: ['left-pad']` and sets `builtin: []`, so sandboxed code cannot directly load `child_process`. However, after the sandboxed code executes `require('evil-left-pad')`, vm2 still loads the colliding package from a host path. The colliding package's top-level code successfully invokes the host `child_process` module and prints `HOST_EXEC`. This issue does not mean that vm2 automatically downloads malicious packages from npm at runtime. The attack requires the colliding package to already be in a path resolvable by the custom resolver, or for the target application's own dependency resolution / download workflow to place that package in such a path. This precondition limits the affected scenarios, but it does not change the core vulnerability: the `external` allowlist is not enforced against complete package-name boundaries, allowing sandboxed code to load a host package that the application did not authorize. ### PoC An independent PoC is attached in the `poc` directory. The PoC installs vm2 `3.11.5`, creates a temporary host package directory, and writes an unauthorized `evil-left-pad` package into it. Run the following from the `poc` directory: ```bash npm install node poc.js ``` When the vulnerability is present, the output is similar to: ```text [+] vm2 version: 3.11.5 [+] customRoot: /tmp/vm2-resolver-poc-xxxxxx/custom [+] Direct sandbox require("child_process") is blocked: ENOTFOUND [+] Unrelated package is blocked: ENOTFOUND [+] require("evil-left-pad") result: HOST_EXEC [+] RESULT: VULNERABLE ``` `HOST_EXEC` is produced by the top-level code of the `evil-left-pad` package through host-side `child_process.execFileSync()`, demonstrating that the unauthorized package has executed in the host context. Expected result: when the `external` allowlist only contains `left-pad`, `evil-left-pad` should be rejected. Actual result: `evil-left-pad` passes the check because it contains the `left-pad` substring and then executes in the host context. ### Impact Under the affected configuration, an attacker can load a colliding host package that is not allowed by the `external` allowlist through sandboxed code, breaking `NodeVM`'s module access control. If the attacker can control or influence the contents of the colliding package, for example by placing a malicious package through a plugin upload directory, a user-controllable dependency directory, a private registry synchronization directory, an application-specific dependency download workflow, or another path reachable by the resolver, the attacker can further execute code in the host Node.js process context. The attacker may read files, environment variables, and secrets accessible to the host process, modify host-writable data, or interrupt the host service. The main exploitation prerequisites are: - The application uses vm2 `NodeVM` to execute untrusted or low-trust JavaScript code. - The application enables a `require.external` allowlist instead of allowing all external packages. - The application configures a custom `require.resolve`. - The colliding package already exists in a path resolvable by that custom resolver, or the application's workflow downloads / synchronizes it into that path. - The application loads external packages in the host context, or keeps the relevant default behavior. If the deployed custom resolver only searches a fixed dependency directory that is fully trusted and cannot be influenced by an attacker, practical exploitability is reduced. However, in scenarios such as plugin systems, user scripts, uploadable dependency packages, private package-source synchronization, or multi-tenant sandbox platforms, this vulnerability can bypass the sandbox boundary. ### Credit This vulnerability was discovered by: - XlabAI Team of Tencent Xuanwu Lab ([email protected]) - Atuin Automated Vulnerability Discovery Engine - Guannan Wang ([email protected]), Zhanpeng Liu ([email protected]), Jiashuo Liang ([email protected]), Guancheng Li ([email protected])

Source published

1 Oct 2026 15:37:19 UTC

Source modified

1 Oct 2026 15:45:05 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V3 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Publisher rating · CRITICAL