I Traced vm2's 9.5 Sandbox Escape to a Missing Regex Boundary

allowlisted: .../node_modules/foo/index.js recorded as: ^\.\.\.\/node_modules\/foo `/tmp/vm2-prefix-case/node_modules/${module}` }, context: 'host', // NodeVM default }); // guest code: // require('foo') -> prefix recorded: ^/tmp/vm2-prefix-case/node_modules/foo // require('/tmp/vm2-prefix-case/node_modules/foo2/index.js') -> passes the prefix The first require is legitimate: the resolver answers with /tmp/vm2-prefix-case/node_modules/foo, and vm2 records that prefix. The second require points at foo2, a completely different, non-allowlisted package whose path happens to start with the same ch