vm2 before 3.11.7 Remote Code Execution via require.external

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92946 · CVE overview and exploitation status

EUVD-2026-81595

GHSA-29x6-9qh5-83gg

GHSA-j3hm-6rg5-mchv

cve-program · CVE-2026-92946

• https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external

euvd · EUVD-2026-81595

• https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external

nvd · CVE-2026-92946

• https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external

osv · GHSA-29x6-9qh5-83gg

• https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv
• https://nvd.nist.gov/vuln/detail/CVE-2026-92946
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external

osv · GHSA-j3hm-6rg5-mchv

• https://github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv
• https://nvd.nist.gov/vuln/detail/CVE-2026-92946
• https://github.com/patriksimek/vm2/commit/903017c8a1eae9aba947ec854468b48155e79f86
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external

• vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM … · Advisory content revised · 1 Nov 2026