Critical severity10.0NVD Advisory· Published Sep 17, 2026· Updated Sep 17, 2026
CVE-2026-92946
CVE-2026-92946
Description
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vm2npm | < 3.11.7 | 3.11.7 |
Affected products
1- Range: <3.11.7
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-j3hm-6rg5-mchvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-92946ghsaADVISORY
- github.com/patriksimek/vm2/commit/903017c8a1eae9aba947ec854468b48155e79f86ghsaWEB
- github.com/patriksimek/vm2/releases/tag/v3.11.7ghsaWEB
- github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchvnvdWEB
- www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-externalnvdWEB
News mentions
1- vm2 npm Package: 25 Critical Sandbox Escape Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 18, 2026