CVE-2026-92946 in vm2
Summary
by MITRE • 09/17/2026
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in versions of the vm2 library prior to 3.11.7 represents a critical remote code execution flaw rooted in improper access control mechanisms within its sandboxing implementation. The core issue arises when the configuration option require.external is enabled without an accompanying explicit require.root setting that specifically excludes the node_modules directory. This misconfiguration creates a security gap where the isolation boundaries intended to contain malicious or untrusted JavaScript code are effectively bypassed, allowing execution context leakage from the sandbox back into the host environment.
From a technical perspective, vm2 operates by creating a virtual machine instance that restricts access to Node.js built-in modules and global objects. However, when require.external is active, it permits the loading of specific external packages defined in its whitelist. The flaw occurs because this mechanism does not sufficiently validate or isolate the loaded modules from sensitive system-level APIs if the root directory for module resolution includes node_modules. An attacker can exploit this by crafting a payload that requires vm2's own package within the sandboxed environment. Once inside, the malicious code instantiates an unrestricted NodeVM instance, effectively nesting virtual machines but with elevated privileges due to the flawed configuration of the outer VM.
The operational impact of this vulnerability is severe, as it allows for arbitrary command execution on the host operating system. By leveraging child_process modules accessible through the improperly configured sandbox, an attacker can spawn shell processes and execute any OS-level commands available to the user running the Node.js application. This transforms a potential code injection issue into full system compromise, enabling data exfiltration, lateral movement within networked environments, or complete destruction of infrastructure depending on the privileges of the compromised process. The ability to instantiate an unrestricted VM means that standard sandbox escape techniques are rendered ineffective because the attacker gains direct access to Node.js internals that should remain hidden from untrusted code.
This vulnerability aligns with CWE-94 Improper Control of Generation of Code, specifically involving server-side script interpretation flaws where user input influences dynamic code generation or execution contexts without adequate sanitization or isolation boundaries. In terms of adversary behavior mapping under the MITRE ATT&CK framework, this exploit path corresponds to T1059 Command and Scripting Interpreter, particularly sub-techniques related to JavaScript and Node.js usage for executing arbitrary commands on a compromised host system. The exploitation chain demonstrates how misconfigured security controls can lead directly to privilege escalation within application runtime environments.
Mitigation strategies must focus on strict configuration management of the vm2 library. Organizations should immediately upgrade to version 3.11.7 or later, where these access control checks have been hardened. For applications that cannot update immediately due to compatibility constraints, it is imperative to explicitly configure require.root to exclude node_modules and any other directories containing sensitive modules. Additionally, developers should audit their use of vm2 to ensure that external module loading is restricted to a minimal whitelist of trusted packages that do not expose dangerous APIs like child_process or fs. Implementing these configuration changes restores the intended isolation boundaries and prevents unauthorized access to host system resources through sandbox escape vectors.