CVE-2026-100721: vm2 (npm)

Should you act?

Critical and remotely reachable

No known exploitation yet, but it is network-reachable without credentials. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.

Not in CISA KEV, but CISA’s SSVC assessment records a public proof-of-concept, so attack code exists.
EPSS 0.4%, percentile 33: FIRST’s model estimates a 0.4% chance of exploitation activity in the next 30 days, higher than 33% of all scored CVEs (low). EPSS is a probability, not a verdict.
Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
Only applies if your dependency tree includes vm2 (npm) <= 3.12.1, fixed in 3.12.2. Check your lockfile, including transitive dependencies.
Editorial verdict: Check exposure. vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2 — If anything outside your trust boundary can get code into vm2, upgrade to 3.12.2 today and plan to move that code out of process; if vm2 only runs your own code, upgrade on a normal cycle.

What it is

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures require.external with a custom resolver (and context: 'host'), LegacyResolver.customResolve in lib/resolver-compat.js records the resolved module directory in this.externals as new RegExp('^' + escapeRegExp(resolvedPath)), without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. foo) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. .../nodemodules/foo2/index.js); the sibling passes isPathAllowedForModule and is loaded through hostRequire, so its top-level code runs in the host process before the exports are wrapped with vm.readonly, resulting in a sandbox escape and arbitrary code execution in the host context.

From the GitHub advisory

Summary

At source revision 91034466bfb7f56b95fd48083ec6ca36d058f164 of vm2 3.11.8, an untrusted NodeVM guest can turn one allowlisted custom-resolved module into authorization for a separate file whose path merely shares the resolved path's string prefix. LegacyResolver.customResolve stores the resolved path in this.externals as ^ without an end or separator boundary; a later absolute require of a sibling such as foo2/index.js therefore passes the external check and is loaded through hostRequire when the configured context is host. The decisive attack loaded foo as FOOOK and then executed the prefix-sharing sibling, which returned PREFIXPWN after invoking childprocess; an otherwise identical control denied the sibling with ENOTFOUND.

Technical Details

The affected configuration is a documented NodeVM use in which the embedder sets require.external to {modules: ['foo'], transitive: false}, supplies a custom resolver that returns the foo directory, sets a root directory, and uses context: 'host'. The guest controls the require specifiers and requests the allowlisted bare name before requesting the absolute path of the prefix-sharing sibling. The test entry point is deliberately outside the configured root so ordinary nodemodules lookup misses and the custom resolver is consulted.

The source-to-sink path is:

Weakness type: CWE-863.

Product: vm2 (npm) · Assigned by: VulnCheck · Published: 2026-09-27

Affected and fixed versions

Ecosystem	Package	Vulnerable	First fixed
npm	`vm2`	<= 3.12.1	3.12.2

Vendor	Product	Affected versions (per CVE record)
patriksimek	vm2	< 3.12.2

Severity scores

Scored by	CVSS	Score	Vector
VulnCheck	4.0	9.5 Critical	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`
VulnCheck	3.1	9 Critical	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H`
GitHub	4.0	9.5	`CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H`

Attack vector: network (remotely reachable)
Attack complexity: low
Attack requirements: present (depends on deployment conditions)
Privileges required: none (no login)
User interaction: none

CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.

Exploitation and urgency

CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
CISA SSVC assessment: exploitation poc, automatable no, technical impact total.
FIRST EPSS (model of 2026-10-21): 0.40% probability of exploitation activity in the next 30 days; percentile 33.

Timeline

2026-08-17 — erroneo.us brief: vm2: 22 Critical Sandbox Escapes, Fixed in 3.12.2
2026-09-27 — CVE record published by VulnCheck
2026-09-28 — CVE record last updated
2026-10-05 — GitHub-reviewed advisory GHSA-5h3f-q97h-ccvc published (critical)

Sources and references

Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.