vm2 EUVD-2026-81607

Requires the embedder to configure NodeVM with the builtin wildcard combined with negative denylist entries - specifically a pattern like require: { builtin: ['*', '-fs', '-child_process'] } - because exact-name matching in lib/builtin.js leaves subpath modules (fs/promises, node:fs/promises) reachable. It also requires the fundamental vm2 deployment mode of executing attacker-controlled/untrusted JavaScript in the sandbox. It does NOT trigger on default configurations or on allowlist-style builtin restrictions; deployments that omit fs from an allowlist entirely, or that never use wildcard-plus-negative denylists, are not exposed. No user interaction and no host authentication beyond the ability to run sandbox code are needed.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VI:H/VA:L, SI:H/SA:L) scores 8.4 (High), reflecting network-reachable, low-complexity code execution against the host filesystem. However, this rating must be read through vm2's threat model: vm2 exists to run UNTRUSTED JavaScript, so the 'attacker' is simply anyone who can submit script to the sandbox - meaning the practical privilege barrier is even lower than PR:L implies (arguably PR:N). The real gating factor is CONFIGURATION, not exploitation difficulty: the flaw only triggers when the embedder uses the builtin wildcard WITH negative entries (e.g. builtin: ['*', '-fs', ...]), a deliberate non-default denylist pattern. No EPSS score, no CISA KEV entry, and no independent POC feed are present in the input, so there is no evidence of at-scale automated exploitation; the risk is realistic-but-conditional rather than mass-exploited. One conflict to flag: the vendor set VC:N (no confidentiality impact), yet the description explicitly states read operations via fs/promises are also reachable - confidentiality IS affected, so the vendor vector likely understates C. Net: a genuine, high-impact sandbox-escape class issue for the specific denylist configuration, but its blast radius is bounded by how many deployments use wildcard-plus-negative builtin lists.

An application embeds vm2's NodeVM to run user-supplied JavaScript and hardens it with a denylist like require: { builtin: ['*', '-fs', '-child_process'] }, believing filesystem access is blocked. An attacker submits sandboxed code that calls require('fs/promises') (or require('node:fs/promises')), which the exact-name denylist never removed, and invokes fsp.writeFile() to create/overwrite files on the host. The advisory confirms host file creation and writing were demonstrated, so working exploit technique is publicly documented.