Bypassing vm2's External Package Allowlist: A Deep Dive into CVE-2026-92951

Overview

vm2 is a popular sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It provides a way to restrict access to built-in modules and external packages, making it a widely-used solution for plugin systems, user-script platforms, and sandbox execution environments. However, a recently discovered vulnerability, CVE-2026-92951, allows an attacker to bypass the external package allowlist and execute code in the host context, potentially leading to host code execution.

Understanding the Vulnerability / Threat

Root Cause Analysis

The vulnerability lies in the allowlist pre-check logic before the custom resolver is called. vm2 generates a regular expression from the `external` allowlist and uses it to check the original package name supplied by sandboxed code. However, the regular expression is not anchored to the full package-name boundary, performing a substring match on the original package name. This means that if the allowlist only permits `left-pad`, an attacker can still bypass the check with a colliding package name such as `evil-left-pad`. This vulnerability belongs to the CWE-40 category, 'Unrestricted File Upload,' but more specifically, it is a design issue related to the improper use of regular expressions for package name validation.

Attack Surface & Vector

The attack surface is limited to scenarios where the application uses vm2's `NodeVM` to execute untrusted or low-trust JavaScript code, enables a `require.external` allowlist, and configures a custom `require.resolve`. The attacker must be able to influence the contents of the colliding package or place it in a path resolvable by the custom resolver. The attack vector involves the sandboxed code requesting a package with a colliding name, which passes the allowlist pre-check and is then loaded by the custom resolver in the host context.

Exploitation Mechanics — Scenario Walkthrough

Scenario: Compromising a Corporate Jenkins Instance 1. Initial Position: An attacker has limited access to a Jenkins instance with a plugin that uses vm2 to sandbox user scripts. The plugin allows only a specific set of trusted dependencies. 2. Triggering the Flaw: The attacker crafts a malicious package with a colliding name, such as `evil-left-pad`, and uploads it to a directory that is not properly validated by the plugin's custom resolver. 3. What Breaks: The sandboxed code requests the `evil-left-pad` package, which passes the allowlist pre-check due to the substring match vulnerability. The custom resolver loads the package from the host path, and its top-level code executes in the host context. 4. Attacker's Prize: The attacker gains the ability to execute code in the host context, potentially allowing them to read sensitive files, modify host-writable data, or interrupt the host service.

Real-World Impact

The impact of this vulnerability is significant, as it allows an attacker to bypass the sandbox boundary and execute code in the host context. This can lead to a range of malicious activities, including data theft, lateral movement, and ransomware deployment.

Detection & Defense

Immediate Mitigations

* Upgrade vm2 to version 3.11.6 or later. * Configure the custom resolver to only search in trusted directories. * Validate the package name against a list of approved packages.

Detection Strategies

* Monitor for suspicious package requests that pass the allowlist pre-check. * Implement a SIEM rule to detect potential exploitation attempts. * Use MITRE ATT&CK techniques, such as T1190 (Exploit Public-Facing Application), to detect and respond to potential attacks.

Long-Term Hardening

* Implement a defense-in-depth approach by using multiple layers of validation and verification. * Use a more secure package validation mechanism, such as package signing and verification. * Regularly review and update the allowlist and custom resolver configurations.

Key Takeaways

* The CVE-2026-92951 vulnerability allows sandboxed code to bypass the external package allowlist and execute code in the host context. * The vulnerability is caused by a design issue related to the improper use of regular expressions for package name validation. * The attack surface is limited to scenarios where the application uses vm2's `NodeVM` to execute untrusted or low-trust JavaScript code. * Immediate mitigations include upgrading vm2, configuring the custom resolver, and validating package names.

Sources

* GitHub Security Advisories: https://github.com/advisories/GHSA-c48m-32m9-vx93