vm2 CVE-2026-92946

Requires the embedding application to (1) run untrusted attacker-supplied JavaScript inside vm2 (the sandbox's threat model) AND (2) enable require.external WITHOUT an explicit require.root that excludes node_modules - this specific configuration is the trigger. Under that config the sandbox can require('vm2') itself and build an unrestricted NodeVM. Limiting factors: both preconditions are operator-chosen and non-default; applications that leave require.external disabled, or that set require.root to exclude node_modules, are not exploitable. Fixed in vm2 3.11.7. No user interaction or host-side authentication beyond the ability to feed code into the sandbox.

CVSS 4.0 base scores 10.0 (all impact metrics High, AV:N/AC:L/PR:N/UI:N with subsequent-system SC:H/SI:H/SA:H reflecting a full sandbox escape), which is credible for a working host RCE: sandboxed code escapes to run arbitrary OS commands via child_process. However, this maximal score is conditional. The vulnerability only manifests when the embedding application enables require.external WITHOUT setting a require.root that excludes node_modules - a non-default, operator-chosen configuration. It also presupposes the core vm2 threat model: the application is deliberately running attacker-controlled JavaScript inside the sandbox. No EPSS score, no CISA KEV listing, and no independently confirmed public exploit are present in the input (a POC is likely embedded in the GHSA advisory but is not confirmed here). So this is a genuine high-severity RCE for the specific population running the vulnerable config, but the 10.0 overstates blanket real-world risk: exploitation is gated on both a misconfiguration and an application design that feeds untrusted code to vm2. Treat as high priority for any service that loads untrusted JS in vm2 with require.external enabled; deprioritize elsewhere. Note vm2 is deprecated/unmaintained, which raises exposure for laggards but lowers the count of actively-maintained deployments.

An application uses vm2 to execute untrusted user-supplied JavaScript and has enabled require.external to let sandboxed code load modules, without an explicit require.root excluding node_modules. The attacker submits JS that does require('vm2'), spins up a fresh unrestricted NodeVM, and from it calls child_process to run host OS commands (e.g. spawn a reverse shell). A POC is likely present in the vendor advisory, though not independently confirmed here.