vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package (Critical severity, CVE-2026-92951)
A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.
Key points
- vm2 (npm) has a critical flaw.
- Tracked as CVE-2026-92951.
- Version 3.11.7.
Maintainers of vm2, a package in the npm ecosystem, have published a critical-severity security advisory (CVE-2026-92951): vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package.
At a glance
- Advisory
- GHSA-c48m-32m9-vx93
- CVE
- CVE-2026-92951
- Package
- vm2 (npm)
- Severity
- Critical
- Patched in
- 3.11.7
What is the issue?
The GitHub-reviewed advisory explains: Summary vm2 is a sandbox library for isolating and executing untrusted JavaScript code inside a Node.js process. It can restrict access to built-in modules and external packages. When NodeVM enables an external allowlist together with a custom resolve callback, vm2 checks the requested package name with a non-exact match. For example, if the allowlist only permits left-pad, an attacker can still bypass the check with a colliding package name such as evil-left-pad, because it contains the allowlisted name. If the colliding package already exists in a host path resolvable by the custom resolver, or if the target application's custom resolver / dependency-management workflow downloads the package and places it in a resolvable path, vm2 loads and executes that package in the host context. This lets sandboxed code bypass the module allowlist and may further lead to host code execution. Detail
Affected versions
| Ecosystem | Package | Vulnerable | Patched |
|---|---|---|---|
| npm | vm2 | <= 3.11.6 | 3.11.7 |
The advisory lists a CVSS score of 9.9.
How to fix it
- Upgrade the affected package to the first patched version listed above.
- Rebuild and redeploy applications that bundle the vulnerable dependency.
- Run your dependency scanner (npm audit, pip-audit, Dependabot) to find transitive uses.
- Review the advisory references for workaround details if you cannot upgrade yet.
What to do and how to stay safe: CVE-2026-92951
- Patch scores alone ignore context like network exposure and asset criticality.
- You must map vulnerabilities to specific business risks to prioritize correctly.
- Continuous exposure data replaces static scanning for accurate prioritization.
Prioritize vulnerabilities by actual exploitability and business impact, not by theoretical severity scores. Update your asset context and exposure data continuously to maintain accurate risk rankings.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-92951?
CVE-2026-92951 is a security vulnerability in vm2 (npm).
Which version fixes CVE-2026-92951?
The fix is in version 3.11.7.
