Duplicate Advisory: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

🗓️ 17 Sep 2026 15:32:15Reported by GitHub Advisory DatabaseType

Remote code execution in vm2 when require.external is enabled without require.root.

Reporter	Title	Published	Views	Family All 15
BDU FSTEC	The vulnerability of the require.external component of the vm2 package manager NPM allows a attacker to execute arbitrary code.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92946	17 Sep 202616:09	–	circl
CVE	CVE-2026-92946	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92946 vm2 before 3.11.7 Remote Code Execution via require.external	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81595	5 Oct 202622:34	–	euvd
Github Security Blog	vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE	5 Oct 202622:34	–	github
NVD	CVE-2026-92946	17 Sep 202614:17	–	nvd
OSV	GHSA-J3HM-6RG5-MCHV vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE	5 Oct 202622:34	–	osv
Patchstack	NPM: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE	5 Oct 202622:34	–	patchstack
Positive Technologies	PT-2026-94317	25 Aug 202600:00	–	ptsecurity

Vulners

Node

vm2_project vm2Range≤3.11.6npm

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-j3hm-6rg5-mchv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92946
vulncheck	www.vulncheck.com/advisories/vm2-before-3.11.7-remote-code-execution-via-require-external
github	www.github.com/advisories/GHSA-29x6-9qh5-83gg

05 Oct 2026 22:34Current

6.7Medium risk

Vulners AI Score6.7

CVSS 410

CVSS 3.110

EPSS0.00857

SSVC