CVE-2026-92946: vm2 Critical RCE Vulnerability via Unrestricted Host Filesystem Access
Summary
CVE-2026-92946: NodeVM's require.external option lets sandboxed code require() local files and npm packages. Affects vm2 versions < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular Node.js library that provides a sandboxed environment for executing untrusted code. It allows developers to run JavaScript code in a secure context, isolating it from the host environment. This is particularly useful for applications that need to execute user-generated scripts without exposing the underlying system to potential harm. However, a critical vulnerability has been identified in vm2 that can lead to remote code execution (RCE) if not properly configured.
Vulnerability Detail
The vulnerability arises from the NodeVM's require.external option, which allows sandboxed code to require local files and npm packages. If require.external is enabled without explicitly setting require.root to a safe path, it defaults to unrestricted access. This means that sandboxed code can load and execute arbitrary files from the host filesystem, including the vm2 package itself, leading to full RCE. The issue is exacerbated by the default context being set to 'host', allowing the use of the real Node.js require() function, which bypasses any sandbox restrictions.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot update to the patched version immediately, a temporary workaround is to disable the require.external option entirely or set require.root to a directory that excludes node_modules. For example:
const { NodeVM } = require('vm2');
const vm = new NodeVM({
require: {
external: false,
root: './safe-directory',
},
});
Conclusion
The vm2 package has a critical vulnerability that allows unrestricted host filesystem access and full remote code execution if not properly configured. It is essential to update to the latest version and follow best practices to secure your application against this threat.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 10.0, indicating a critical severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If left unaddressed, this vulnerability allows attackers to execute arbitrary commands on the host system, potentially leading to data breaches or system compromise.
Yes, ensure that require.root is explicitly set to a path that does not include node_modules when using require.external.
The impact includes the ability for untrusted code to execute arbitrary OS commands and access sensitive files, effectively bypassing all sandbox restrictions.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
