Secuno
ENNL
Book demo

CVE-2026-92946

10.0 CRITICAL
  1. Published17 Sept 2026

Description

vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules. Sandboxed code can require vm2's own package, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands via child_process.

CVSS 3.1 breakdown

Attack vectorNetwork
Attack complexityLow
Privileges requiredNone
User interactionNone
ScopeChanged
ConfidentialityHigh
IntegrityHigh
AvailabilityHigh
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

CVE-2026-9295510.0
vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows…
CVE-2026-9295310.0
vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer…
CVE-2026-929359.0
vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <=…
CVE-2026-651818.1
Insufficient authorization of Data Source tables in Impala 2.7-4.5 allows a client with…
CVE-2026-418708.8
Missing Authorization, Improper Control of Generation of Code ('Code Injection'),…
CVE-2026-592839.1
Applications that evaluate Spring Expression Language (SpEL) expressions using…

Frequently asked

Is CVE-2026-92946 being actively exploited?

CVE-2026-92946 is not in the CISA KEV catalog.

How severe is CVE-2026-92946?

CVE-2026-92946 has a CVSS 3.1 base score of 10.0, rated critical.

How do I fix CVE-2026-92946?

Apply the vendor's patch or advisory guidance, then verify no affected versions remain across your devices.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2026-92946 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation worksBook a demo

Data from the NVD, CISA KEV catalog and FIRST EPSS. CVSS 3.1 base score shown where available.