Remote Code Execution Vulnerability in vm2 by Patrik Simek
CVE-2026-92946

10CRITICAL

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
17 September 2026

What is CVE-2026-92946?

The vm2 package, prior to version 3.11.7, is susceptible to a remote code execution vulnerability that arises when the require.external function is enabled without proper restrictions through require.root. This misconfiguration permits maliciously crafted code running within a sandbox to require the vm2 package itself, leading to the instantiation of an unrestricted NodeVM instance. As a result, attackers could execute arbitrary commands on the host operating system using Node.js's child_process module, potentially leading to severe security implications. Organizations leveraging vm2 should upgrade to the latest version to mitigate this risk.

Affected Version(s)

vm2 0 < 3.11.7

vm2 3.11.7

References

https://github.com/patriksimek/vm2/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/vm2-before-3.11.7-re...
third-party-advisory

CVSS V4

Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

abisheikM1
amagesh1
Den1al
.