CVE-2026-92946 vm2 before 3.11.7 Remote Code Execution via require.external
Attackers can execute arbitrary host commands if require.external is enabled without proper root restrictions in the vm2 sandbox library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92946?
CVE-2026-92946 is a critical code injection vulnerability in patriksimek vm2, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.
Weakness: CWE-913
Which versions are affected by CVE-2026-92946?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | All versions | 3.11.7 |
vm2 npm | All versions | 3.11.7 |
How do I fix CVE-2026-92946?
Upgrade vm2 to 3.11.7 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2026-92946 being exploited?
There is no known exploitation of CVE-2026-92946 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-DN17420, ECHO-43a8-b41f-3483, GHSA-j3hm-6rg5-mchv, MINI-fcrr-7j74-vq9c, ROOT-APP-NPM-CVE-2026-92946.