CVE-2026-92950: Vm2 Nodevm External Require Without Rootcve-2026-92950-vm2-nodevm-external-require-without-root
NodeVM is configured with `require.external` enabled but without a `require.root` boundary, and external code runs in the host realm (the default `require.context` is 'host'). Sandboxed code can then require() any attacker-named path, including its own script file, and the module is loaded through the real host require() and executes in the host Node.js proc
