vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures "require.external" with a custom resolver (and "context: 'host'"), "LegacyResolver.customResolve" in lib/resolver-compat.js records the resolved module directory in "this.externals" as "new RegExp('^' + escapeRegExp(resolvedPath))", without requiring a path separator or end-of-string boundary. Untrusted guest code can therefore require the allowlisted module (e.g. "foo") and then require the absolute path of a non-allowlisted sibling whose path merely shares the resolved prefix (e.g. ".../node_modules/foo2/index.js"); the sibling passes "isPathAllowedForModule" and is loaded through "hostRequire", so its top-level code runs in the host process before the exports are wrapped with "vm.readonly", resulting in a sandbox escape and arbitrary code execution in the host context.