cyfenced.com →

[ CVE-2026-92946 · Published 17 Sep 2026 ]

vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

CVSS 10.0 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 10.0

[ Description ]Official description

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.

[ Fixes ]Fixes and patches

  • vm2 3.11.7Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.11.7 or later (affected <= 3.11.6)

[ Packages ]Affected open-source packages

[ References ]References