CVE-2026-92938

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with 'node:' as a core-module request and the runtime strips only one 'node:' prefix, so a sandbox request for 'node:node:sqlite' resolves to the configured node:sqlite entry. Sandboxed code can therefore create an in-memory DatabaseSync with extension loading enabled and call DatabaseSync.loadExtension() on a native library bundled in the untrusted plugin package (path derived from __dirname). SQLite loads the library into the Node.js host process and invokes its native entry point, giving the sandboxed plugin arbitrary native code execution outside the sandbox with the host process's privileges. The issue is fixed in vm2 3.11.7.

• CWE-693

• https://github.com/patriksimek/vm2/security/advisories/GHSA-6w8r-xxw2-g3hx
• https://www.vulncheck.com/advisories/vm2-3.11.3-through-3.11.6-remote-code-execution-via-node-sqlite
• https://github.com/patriksimek/vm2/security/advisories/GHSA-6w8r-xxw2-g3hx

Published

Sep 17, 2026

Last Modified

Sep 19, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-92932In the MISP sachertortephp library, the Xml::build() static …5.1
• CVE-2026-92933vm2 is a sandbox for running untrusted Node.js code. In vers…5.8
• CVE-2026-92934vm2 before 3.11.8 contains an incomplete fix for Error.cause…9
• CVE-2026-92935vm2 is a sandbox for running untrusted Node.js code. In vers…9
• CVE-2026-92936vm2 versions 3.11.0 through 3.11.6 leak absolute host filesy…5.8
• CVE-2026-92937vm2 3.11.6 is vulnerable to a sandbox escape leading to remo…10
• CVE-2026-92939vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto mo…9.9
• CVE-2026-9294A vulnerability was identified in Edimax BR-6428NS 1.10. The…8.8
• CVE-2026-92940vm2 versions 3.11.3 through 3.11.6 expose the host process's…10
• CVE-2026-92941vm2 versions from 3.11.3 before 3.11.7 expose the host tls m…10
• CVE-2026-92942vm2 before 3.11.7 (affected versions <= 3.11.6) does not enf…7.5
• CVE-2026-92943Improper validation of certificate with host mismatch in the…8.1