Authorization Bypass Vulnerability in vm2 by Patrik Simek

CVE-2026-100721

What is CVE-2026-100721?

The vm2 package prior to version 3.12.2 introduces a critical vulnerability allowing unauthorized access through its external-module resolver. Specifically, when the require.external option is configured with a custom resolver and set to context: 'host', the vulnerability allows untrusted code to exploit the LegacyResolver.customResolve mechanism. This flaw permits the accidental loading of non-allowlisted modules alongside allowlisted ones, enabling sandbox escapes and the execution of arbitrary code within the host context. This exposes applications to significant risks, necessitating prompt updates to versions 3.12.2 or later.

References