CVE-2026-92938
vm2 allows a sandboxed plugin to execute native code through `node:sqlite`
vm2 3.11.6 exposes Node.js's host node:sqlite module to NodeVM code when that builtin is allowed explicitly or through builtin: ['*']. The module is wrapped as read-only, but callable methods retain host-process authority. A sandboxed plugin can construct an in-memory database with extension loading enabled and call DatabaseSync.loadExtension() on a native library bundled in the plugin directory.
- No known exploitation
- Severity
- Critical, CVSS 9.9 (v3.1)
- EPSS
- 0.62% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) >= 3.11.3, <= 3.11.6, fixed in 3.11.7 · GHSA-6w8r-xxw2-g3hx