CVE-2026-92946
vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE
NodeVM's require.external option lets sandboxed code require() local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes node_modules, two defaults combine to fully defeat the sandbox:
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- EPSS
- 0.86% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) <= 3.11.6, fixed in 3.11.7 · GHSA-j3hm-6rg5-mchv