CVE-2026-92951
vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package
vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages.
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.54% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) <= 3.11.6, fixed in 3.11.7 · GHSA-c48m-32m9-vx93