CVE-2026-92945 in vm2
Summary
by MITRE • 09/17/2026
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in versions of vm2 prior to 3.11.7 represents a critical security flaw within the module resolution logic, specifically located in the isPathAllowedForModule function. This component is responsible for determining whether a requested JavaScript module falls within an approved set of packages defined by the application's allowlist. The core technical deficiency lies in the method used to validate these paths against the whitelist. Instead of employing boundary-anchored comparisons that ensure exact matches or proper path segment delineation, the implementation relies on raw string prefix matching. This approach fails to account for directory boundaries effectively, allowing an attacker to craft a module request that appears to match an allowed package based solely on its initial characters rather than its complete and distinct identity.
In practical terms, this flaw enables attackers to bypass security controls designed to restrict access to specific libraries or system modules. When transitive loading is disabled, the sandbox environment typically prevents scripts from requiring any module not explicitly listed in the allowlist. However, due to the prefix-matching logic, a malicious script can perform relative requires that start with the name of an allowed package but extend into unauthorized directories or load different packages entirely. For instance, if vm2 allows access to lodash, it might inadvertently also permit access to lodash-fake or other modules located in sibling directories because they share the same initial string sequence. This bypass effectively neutralizes the intended isolation provided by the allowlist mechanism, granting execution context outside the permitted boundaries.
The operational impact of this vulnerability is significant for applications relying on vm2 to execute untrusted code within a sandboxed environment. By exploiting this path traversal via prefix matching, an attacker can potentially load arbitrary modules that were not intended to be accessible. This could lead to information disclosure if sensitive internal libraries are exposed, or more severely, remote code execution if the loaded module contains exploitable logic or interacts with Node.js APIs in dangerous ways. The vulnerability undermines the fundamental security model of sandboxing, as it allows escape from the restricted context into a broader system environment where standard privileges apply.
This issue aligns closely with CWE-20 Improper Input Validation and CWE-78 Improper Neutralization of Special Elements used in an OS Command, specifically regarding path traversal mechanisms. From a threat modeling perspective using MITRE ATT&CK, this behavior facilitates lateral movement within the application's module space and can be categorized under techniques related to unauthorized access or privilege escalation depending on the surrounding context. To mitigate this risk, organizations must upgrade vm2 to version 3.11.7 or later where the path validation logic has been corrected to use proper boundary-anchored comparisons. Additionally, developers should ensure that allowlists are as restrictive as possible and consider implementing additional runtime checks to verify module integrity before execution.