CVE-2026-92938: vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['']. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with 'node:' as a core-module request and the runtime strips only one 'node:' prefix, so a sandbox request for 'node:node:sqlite' resolves to the configured node:sqlite entry. Sandboxed code can therefore create an in-memory DatabaseSync with extension loading enabled and call DatabaseSync.loadExtension() on a native library bundled in the untrusted plugin package (path derived from dirname). SQLite loads the library into the Node.js host process and invokes its native entry point, giving the sandboxed plugin arbitrary native code execution outside the sandbox with the host process's privileges. The issue is fixed in vm2 3.11.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7 - Configuration
Do not permit access to host core modules inside NodeVM (avoid builtin: ['*'] / builtin permitting 'node:sqlite'); only allow specific builtins required by the application.
vm2 NodeVM builtin = []
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vm2 3.11.3 through 3.11.6 are exposed when untrusted code runs in NodeVM and the node:sqlite builtin is permitted, either explicitly or through builtin: ['*']. The affected code can execute native code with the privileges of the Node.js host process.
What does an attacker need to exploit this issue?
An attacker needs the ability to run code in the affected NodeVM and have a native library bundled in their untrusted plugin package. They can use the package's __dirname-derived path to load that library through SQLite extension loading.
Are default builtin restrictions sufficient to prevent exploitation?
The issue depends on node:sqlite being allowed. Configurations that explicitly permit node:sqlite or allow all builtins with builtin: ['*'] are affected; the provided information does not establish exposure for configurations that do not permit that builtin.
How can I determine whether a deployment is affected?
Check whether vm2 is version 3.11.3 through 3.11.6, whether untrusted code is executed with NodeVM, and whether its builtin configuration permits node:sqlite directly or via builtin: ['*']. Also review whether untrusted plugins can include native libraries.
What should be done to remediate the issue?
Upgrade vm2 to version 3.11.7. Until upgrading, prevent NodeVM sandboxed code from accessing node:sqlite and avoid wildcard builtin permissions that include it.