CVE-2026-92951: vm2 Package Allows Bypass of External Package Allowlist via Colliding Host Package
Summary
CVE-2026-92951: vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. Affects vm2 versions < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
vm2 is a popular sandbox library designed for executing untrusted JavaScript code within a Node.js environment. It provides a secure way to isolate code execution by restricting access to built-in modules and external packages. However, the library's configuration options, particularly regarding external package management, can introduce vulnerabilities if not properly managed.
Vulnerability Detail
The vulnerability arises from the way vm2 handles the external package allowlist when a custom module resolver is used. Specifically, the allowlist check is performed using a non-exact substring match, which allows an attacker to bypass the intended restrictions. For instance, if 'left-pad' is the only allowed package, an attacker could exploit this by using a package named 'evil-left-pad', which contains the allowed substring. This could lead to unauthorized code execution in the host context, potentially allowing the attacker to access sensitive information or disrupt services.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using custom resolvers with the external allowlist feature in vm2 until the package is updated. If you must use a custom resolver, ensure that it only points to trusted directories that cannot be influenced by untrusted users.
Conclusion
The vm2 package has a critical vulnerability that allows attackers to bypass the external package allowlist through colliding package names. It is essential to update to the patched version to mitigate this risk. Additionally, users should be aware of the potential impacts and consider workarounds if an immediate update is not feasible.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
An attacker could execute unauthorized code in the host context, potentially accessing sensitive data, modifying files, or disrupting services.
Yes, this vulnerability affects vm2 versions up to and including 3.11.6. It is fixed in version 3.11.7 and later.
If an immediate update is not possible, consider implementing workarounds such as avoiding custom resolvers or restricting access to trusted directories.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
