CVE-2026-100721
vm2: NodeVM custom resolution bypasses external path boundaries
At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the resolved path in this.
- No known exploitation
- Severity
- Critical, CVSS 9.5 (v4.0)
- EPSS
- 0.4% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) <= 3.12.1, fixed in 3.12.2 · GHSA-5h3f-q97h-ccvc