Skip to content
CVE PROGRAM SOURCE RECORD10.0 Critical

CVE-2026-92946

vm2 before 3.11.7 Remote Code Execution via require.external

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

patriksimek vm2

Default version status: unaffected

  • 0 to < 3.11.7affected
  • 3.11.7unaffected
pkg:npm/vm2

References