usebruno/bruno · error · Error

Access to files outside of the allowed context roots is not

Error message

Access to files outside of the allowed context roots is not allowed: ${moduleName}

Allowed context roots:
${allowedRootsDisplay}

What it means

Thrown by the CJS module loader's loadLocalModule function during the preliminary path security check. Before resolving the module, the loader resolves the raw module name against the current module directory and verifies the resulting path is within the configured additionalContextRootsAbsolute list using isPathWithinAllowedRoots. If the raw require path resolves outside all allowed roots, this error is thrown at cjs-loader.js:141-147.

Source

Thrown at packages/bruno-js/src/sandbox/node-vm/cjs-loader.js:143

/**
 * Loads a local module from the filesystem with security checks and caching
 * @param {Object} options - Configuration options
 * @returns {*} The exported content of the loaded module
 * @throws {Error} When module is outside collection path or cannot be loaded
 */
function loadLocalModule({
  moduleName,
  collectionPath,
  isolatedContext,
  localModuleCache,
  currentModuleDir,
  additionalContextRootsAbsolute = []
}) {
  // Validate the raw module name doesn't try to escape allowed roots
  const preliminaryPath = path.resolve(currentModuleDir, moduleName);
  if (!isPathWithinAllowedRoots(path.normalize(preliminaryPath), additionalContextRootsAbsolute)) {
    const allowedRootsDisplay = additionalContextRootsAbsolute.map((root) => `  - ${root}`).join('\n');
    throw new Error(
      `Access to files outside of the allowed context roots is not allowed: ${moduleName}\n\n`
      + `Allowed context roots:\n${allowedRootsDisplay}`
    );
  }

  // Resolve the module path, handling files and directories
  const normalizedFilePath = resolveLocalModulePath(currentModuleDir, moduleName);

  // Final security check after resolution
  if (!isPathWithinAllowedRoots(normalizedFilePath, additionalContextRootsAbsolute)) {
    const allowedRootsDisplay = additionalContextRootsAbsolute.map((root) => `  - ${root}`).join('\n');
    throw new Error(
      `Access to files outside of the allowed context roots is not allowed: ${moduleName}\n\n`
      + `Allowed context roots:\n${allowedRootsDisplay}`
    );
  }

  // Check cache - we cache moduleObj, return its exports

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Move the required file inside the collection directory (or an allowed context root) and use a relative path from there.
2. Configure additional context roots in the Bruno collection settings if you need to share files across collections.
3. Use only relative paths (./ or ../) that stay within the collection directory structure.

Example fix

// before
const utils = require('../../../shared/utils'); // escapes collection root

// after
// move utils.js into the collection, e.g., under a lib/ folder
const utils = require('./lib/utils');

const path = require('path');
const collectionPath = bru.cwd();
function isWithinCollection(modulePath) {
  const resolved = path.resolve(collectionPath, modulePath);
  const relative = path.relative(collectionPath, resolved);
  return !relative.startsWith('..') && !path.isAbsolute(relative);
}
// before requiring: if (isWithinCollection(modulePath)) require(modulePath);

try {
  const mod = require(modulePath);
} catch (e) {
  if (e.message.includes('outside of the allowed context roots')) {
    console.error('Module path escaped the collection sandbox:', modulePath);
  }
}

When it happens

Trigger: In a Bruno script (node-vm sandbox), calling require('../../../etc/passwd') or require('/absolute/path/outside/collection') where the resolved path is not within any allowed context root. The additionalContextRootsAbsolute list typically includes the collection directory and any explicitly configured additional roots.

Common situations: Trying to import a file outside the Bruno collection directory (e.g., a shared utilities file in a parent directory). Using absolute paths to system files. Attempting directory traversal with ../ sequences that escape the collection root.

Related errors

• Access to files outside of the collectionPath is not allowed
• Invalid file name
• Security error: Symlink "${entry.name}" points outside extra
• Cannot find module ${moduleName}
• Cannot find module ${mod}

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/c0fa3eb3b94c8152. Report an issue: GitHub.