CVE-2026-100721 is a critical authorization bypass in the vm2 NodeVM external-module resolver: before version 3.12.2, untrusted guest code can load a module that isn't on the allowlist, escape the sandbox and run arbitrary code in the host process.
What Is It
The flaw is in LegacyResolver.customResolve in lib/resolver-compat.js. It affects embedders that configure require.external with a custom resolver and context: 'host'. When one of these modules resolves, vm2 records its directory in this.externals as the regex new RegExp('^' + escapeRegExp(resolvedPath)). The regex has no path-separator or end-of-string boundary.
Untrusted guest code can first require an allowlisted module, such as foo. It can then require the absolute path of a sibling module that isn't on the allowlist but starts with the same path, such as .../node_modules/foo2/index.js. The sibling passes isPathAllowedForModule and loads through hostRequire. Its top-level code runs in the host process before its exports are wrapped with vm.readonly. The result is a sandbox escape and arbitrary code execution in the host context.
The weakness is classified as CWE-863 (Incorrect Authorization).
Why It Matters
Applications use vm2 to run untrusted code in isolation. This bug breaks that isolation, so guest code can execute directly in the host.
- CVSS 3.1: 9.0 CRITICAL (
AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H). It is network-reachable, needs no privileges or user interaction, and has a changed scope with high confidentiality, integrity and availability impact. - CVSS 4.0: 9.5 CRITICAL, with attack requirements present. This matches the specific configuration the bug depends on.
The supplied CISA KEV entry is empty, so there is no KEV confirmation of active exploitation for this CVE. NVD lists the record as "Deferred."
What's Vulnerable
- Vendor/Product: patriksimek / vm2 (
pkg:npm/vm2) - Affected: all versions before 3.12.2
- Unaffected: 3.12.2 and later
- Required configuration: NodeVM with
require.externalset to use a custom resolver andcontext: 'host'
Patch Status
vm2 3.12.2 fixes the issue. Upgrade the vm2 npm package to 3.12.2 or later. The upstream repository references three fix commits. There is no CISA KEV required action or due date, because the KEV data contains no entry for this CVE.