CVE-2026-92946: vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCE

NodeVM’s require.external option lets sandboxed code require() local files and npm packages. When require.external is enabled and require.root is not explicitly set to a path that excludes node_modules, two defaults combine to fully defeat the sandbox:

• require.root defaults to unrestricted — “if omitted every path is allowed.”
• require.context defaults to "host" — files loaded this way run through the real Node.js require(), not inside any vm2 sandbox.

Sandboxed code can therefore require() a relative or absolute path to vm2’s own installed package (node_modules/vm2), obtain the real, unwrapped NodeVM/VM classes, construct a brand-new unrestricted nested NodeVM instance, and execute arbitrary host OS commands via child_process.

This is exploitable using vm2’s own documented “Quick Examples” configuration in README.md:

const vm = new NodeVM({
require: {
external: true,
root: './',
},
});

root: './' reads as a safety restriction but, in any ordinary npm project layout, ./node_modules/vm2 sits inside that same directory tree — so the restriction does not exclude vm2 itself. An application built by following the README’s quick-start guide is affected by default.