The vulnerability resides in vm2 versions prior to 3.12.2, where the external-module resolver in the NodeVM component incorrectly records module directory prefixes when a custom resolver is configured with host context. This omission of a path separator or end-of-string boundary allows a crafted module path that shares a prefix with an allowlisted module to bypass the allowed list check. The unaffected code is then loaded through hostRequire, causing its top‑level code to execute directly in the host process before the sandbox enforces immutability, enabling an attacker to escape the sandbox and run arbitrary code on the host system.

The affected product is vm2, a Node.js sandbox library. All releases of vm2 before 3.12.2 are vulnerable; the issue applies to any embedder using the library with require.external set to a custom resolver and context set to host.

The CVSS score of 9.5 indicates a critical impact, and the vulnerability appears to be exploitable when an application supplies untrusted guest code that is loaded via a custom resolver. Although the EPSS score is not available and the flaw is not listed in CISA KEV, the lack of a path check makes exploitation straightforward for a developer or attacker who controls or influences the guest code. The likely attack vector is through the application’s ability to load arbitrary modules within the NodeVM sandbox; no external network access is required beyond the provision of the module code.