fkie_cve-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.

GHSA-7q3f-wx44-378m — vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Affected: npm: vm2

## Summary

`isPathAllowedForModule` decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. `node_modules/foo2` starts with `node_modules/foo`, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relative require from the allowlisted package reaches it even with transitive loading disabled.

## Where it is

`lib/resolver-compat.js`, lines 122 to 132, quoted from HEAD `7a1f5100b96f48d34e0fe104ab37c0acc5944f92`:

```js isPathAllowedForModule(path, mod) { if (!super.isPathAllowed(path)) return false; if (mod) { if (mod.allowTransitive) return true; if (path.startsWith(mod.path)) { const rem = path.slice(mod.path.length); if (!/(?:^|[\\/])node_modules(?:$|[\\/])/.test(rem)) return true; } } return this.externals.some(regex => regex.test(path)); } ```

With `mod.path` of `.../node_modules/foo` and a resolved path of `.../node_modules/foo2/index.js`, `startsWith` is true and `rem` is `2/index.js`, which contains no `node_modules` segment, so the function returns true.

The `node_modules` test in `rem` is what stops a genuine transitive dependency from slipping through. It does not stop a sibling, because a sibling's remainder never contains that segment.

## Impact

Code running in `NodeVM` under an external module allowlist with `transitive: false` can reach a package that was not allowlisted, provided an allowl…

Most recent entries from all

bdu:2026-15016

fkie_cve-2026-92945

GHSA-7q3f-wx44-378m — vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted