CVE-2026-92945: vm2 External Module Allowlist Bypass Vulnerability
Summary
CVE-2026-92945: isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. Affects vm2 versions < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js package that provides a sandboxed environment for executing untrusted code securely. It allows developers to run scripts in a controlled manner, preventing unauthorized access to the host environment. However, a recent vulnerability has been identified that affects the external module allowlist feature, potentially allowing unauthorized access to sibling packages.
Vulnerability Detail
The vulnerability arises from the function 'isPathAllowedForModule' in the vm2 package, which uses a raw string prefix test to determine if a resolved path belongs to an allowlisted external module. This means that if a package shares a prefix with an allowlisted package, it may be incorrectly treated as allowlisted. As a result, code running in NodeVM under an external module allowlist with transitive loading disabled can access packages that were not explicitly allowlisted, provided that an allowlisted package performs a relative require to a prefix-sharing sibling. This could lead to unauthorized code execution and potential security breaches.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can modify the 'isPathAllowedForModule' function in the 'lib/resolver-compat.js' file to require a separator after the prefix. Change the line: 'if (path.startsWith(mod.path))' to 'if (path === mod.path || path.startsWith(mod.path + path.sep))'. This adjustment will prevent sibling packages from being incorrectly treated as allowlisted.
Conclusion
The CVE-2026-92945 vulnerability in the vm2 package poses a significant risk by allowing unauthorized access to sibling packages through improper handling of the external module allowlist. It is crucial to update to version 3.11.7 or later to mitigate this risk. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in your applications.
See every vulnerability recorded for vm2 →
FAQ
CVE-2026-92945 is a vulnerability in the vm2 package that allows unauthorized access to sibling packages due to improper handling of the external module allowlist.
If your application uses vm2 with an external module allowlist, this vulnerability could allow untrusted code to access packages that should not be accessible, leading to potential security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can help you determine if your application is affected by this vulnerability.
If you cannot update the package right away, consider applying the suggested workaround to mitigate the risk until you can perform the update.
The CVSS score of this vulnerability is 4.2, indicating a moderate level of risk associated with its exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
