A remote code execution issue exists when `require.external` is enabled without an explicit `require.root` that excludes `node modules`. This allows sandboxed code to require the vm2 package itself, instantiate an unrestricted NodeVM instance, and execute arbitrary host OS commands using `child process`.