Incorrect authorization in vm2 - #VU161909
Published: November 8, 2026
Vulnerability identifier: #VU161909
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an unauthenticated remote attacker to execute existing host code outside the vm2 NodeVM sandbox.
The vulnerability exists due to missing path-boundary checks when NodeVM authorizes custom-resolved external modules in a configuration using a custom resolver and context: 'host'. An unauthenticated remote attacker can submit guest JavaScript that first requires an allowlisted module and then requires an existing readable sibling file sharing its path prefix, causing the unauthorized file to execute in the host process.
Affected software
vm2
Remediation
Install security update from vendor's website.
vm2 - update to 3.12.2