CVE-2026-92946

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.

  • Published Sep 17, 2026
  • CVSS 10.0 critical
  • 0.9% chance of exploitation in the next 30 days (EPSS)
  • A fix is available

Affected software

CVE-2026-92946 at the National Vulnerability Database