CVE-2026-92946

Summary

The vulnerability allows remote code execution when require.external is enabled without an explicit require.root that excludes node_modules, posing a critical risk.

Exploitability

Exploitation is moderately hard as it requires specific conditions, including the presence of sandboxed code and the ability to require vm2's own package.

Blast radius

If exploited, this could lead to complete control over the host system, including execution of arbitrary commands and potential data exfiltration.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to vm2 version 3.11.7 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.