EUVD-2026-370521

fkie_cve-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.

GHSA-7q3f-wx44-378m — vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Affected: npm: vm2

## Summary

`isPathAllowedForModule` decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. `node_modules/foo2` starts with `node_modules/foo`, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relative require from the allowlisted package reaches it even with transitive loading disabled.

## Where it is

`lib/resolver-compat.js`, lines 122 to 132, quoted from HEAD `7a1f5100b96f48d34e0fe104ab37c0acc5944f92`:

```js isPathAllowedForModule(path, mod) { if (!super.isPathAllowed(path)) return false; if (mod) { if (mod.allowTransitive) return true; if (path.startsWith(mod.path)) { const rem = path.slice(mod.path.length); if (!/(?:^|[\\/])node_modules(?:$|[\\/])/.test(rem)) return true; } } return this.externals.some(regex => regex.test(path)); } ```

With `mod.path` of `.../node_modules/foo` and a resolved path of `.../node_modules/foo2/index.js`, `startsWith` is true and `rem` is `2/index.js`, which contains no `node_modules` segment, so the function returns true.

The `node_modules` test in `rem` is what stops a genuine transitive dependency from slipping through. It does not stop a sibling, because a sibling's remainder never contains that segment.

## Impact

Code running in `NodeVM` under an external module allowlist with `transitive: false` can reach a package that was not allowlisted, provided an allowl…

WID-SEC-W-2026-2997 — vm2: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in vm2 ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen offenzulegen, um Daten zu manipulieren, um einen Denial of Service Angriff durchzuführen und um beliebigen Programmcode auszuführen.

Most recent entries from all

bdu:2026-15016

EUVD-2026-370521

fkie_cve-2026-92945

GHSA-7q3f-wx44-378m — vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

WID-SEC-W-2026-2997 — vm2: Mehrere Schwachstellen