Read the docs
TI-2026-64877 Aliases CVE-2026-100721GHSA-5h3f-q97h-ccvcGHSA-c9wr-qm7p-p6vc

vm2 before 3.12.2 Authorization Bypass via Custom Resolver

Priority HIGH 76CWE-863Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a custom resolver (and `context: 'host'`), `LegacyResolver.customResolve` in lib/resolver-compat.js records the resolved module directory in `this.externals` as `new RegExp('^' + escapeRegExp(resolvedPath))`, without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. `foo`) and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. `.../node_modules/foo2/index.js`); the sibling passes `isPathAllowedForModule` and is loaded through `hostRequire`, so its top-level code runs in the host process before the exports are wrapped with `vm.readonly`, resulting in a sandbox escape and arbitrary code execution in the host context.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00591 48th percentileScored 2026-11-07
Fix Fixed vm2 (patriksimek): 3.12.2vm2 (npm): 3.12.2Red Hat: 1 advisory

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
patriksimekvm2before 3.12.23.12.2Patch availableCNA
—vm2 (npm)before 3.12.23.12.2Patch availableGHSA-5h3f-q97h-ccvc
  • vm2 Vendorpatriksimek Affected before 3.12.2 Fixed in 3.12.2 Patch available CNA
  • vm2 (npm) Vendor— Affected before 3.12.2 Fixed in 3.12.2 Patch available GHSA-5h3f-q97h-ccvc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:*:*:*——patriksimek
  • cpe:2.3:a:vm2_project:vm2:*:*:*:*:*:*:*:* Versions — — ·patriksimek

Remediation

  • Fix · CNA vm2 (patriksimek) Fixed in 3.12.2
  • Fix · GHSA-5h3f-q97h-ccvc vm2 (npm) Fixed in 3.12.2 Advisory →

Red Hat 1 advisory

  • RHSA-2026:88200 Released 2026-10-22 · Red Hat rating Critical
    Ansible automation portal Red Hat Enterprise Linux Images
    • Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    patriksimek vm2 3.12.2

    3 records Highest priority Priority HIGH 2 HIGH, 1 MEDIUM

    Other records, highest priority first

    • TI-2026-64878 vm2 before 3.12.2 Host Process Termination via Construct TrapPriority HIGH 72
    • TI-2026-64879 vm2 before 3.12.2 Memory Disclosure via zlib Buffer PoolPriority MEDIUM 64
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Critical. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2.2Fixed RHSA-2026:88200
Not affected: 2 products
  • Red Hat Developer Hub 1
  • Self-service automation portal 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-100721
  2. 2026-10-03 Alias added: GHSA-c9wr-qm7p-p6vc
  3. 2026-10-06 Alias added: GHSA-5h3f-q97h-ccvc
  4. 2026-10-06 Fix available: npm/[email protected] · GHSA-5h3f-q97h-ccvc
  5. 2026-10-06 CVSS score added · GHSA-5h3f-q97h-ccvc
  6. 2026-10-06 Weakness changed · GHSA-5h3f-q97h-ccvc
  7. 2026-10-06 8 new references · GHSA-5h3f-q97h-ccvc
  8. 2026-10-16 Affected versions changed · Red Hat
  9. 2026-10-16 CVSS score added · Red Hat
  10. 2026-10-18 Affected versions changed · Red Hat
  11. 2026-10-23 Fix available: RHSA-2026:88200 · Red Hat
  12. 2026-10-23 Fix available: Red Hat Ansible Automation Platform 2.2 · Red Hat
  13. 2026-10-27 Affected versions changed · Red Hat

References

Patch 3

Advisory 2

Other 3

  • TI-2023-14382 Sandbox Escape in vm2 CVSS 3.1CRITICAL 10.0
  • TI-2023-13478 vm2 Sandbox Escape vulnerability CVSS 3.1CRITICAL 10.0
  • TI-2026-63070 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species CVSS 4.0CRITICAL 10.0
  • TI-2026-63067 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function CVSS 4.0CRITICAL 10.0
  • TI-2026-62623 vm2 before 3.11.6 Process-wide State Exposure via os and dns CVSS 4.0CRITICAL 10.0
  • TI-2026-62618 vm2 before 3.11.8 Sandbox Escape via NodeVM CVSS 4.0CRITICAL 10.0
See all 80 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences