CVE-2026-92946: vm2 before 3.11.7 Remote Code Execution via require.external
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes nodemodules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via childprocess.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7 - Configuration
If using vm2, ensure require.external is not enabled; the RCE occurs when require.external is enabled without an explicit require.root that excludes node_modules (vm2 before 3.11.7).
vm2 NodeVM require.external = disabled
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vm2 before 3.11.7 are exposed when require.external is enabled and require.root is not explicitly configured to exclude node_modules.
What does an attacker need to exploit the vulnerability?
An attacker needs the ability to execute code inside the affected vm2 sandbox. The sandboxed code can then require vm2's own package, create an unrestricted NodeVM instance, and run host OS commands through child_process.
Is an unmodified configuration necessarily affected?
The issue depends on require.external being enabled and on the absence of an explicit require.root setting that excludes node_modules. Configurations that do not meet those conditions are not described as affected.
What mitigation is available if upgrading is delayed?
Disable require.external, or explicitly configure require.root so that node_modules is excluded. This prevents the described path in which sandboxed code loads vm2's own package.
How can I identify potentially affected instances?
Check for vm2 versions before 3.11.7, then review NodeVM sandbox configuration for require.external enabled without an explicit require.root excluding node_modules.