{"id":25359,"date":"2026-09-18T00:32:28","date_gmt":"2026-09-17T16:32:28","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-92938"},"modified":"2026-09-18T00:32:28","modified_gmt":"2026-09-17T16:32:28","slug":"cve-2026-92938","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-92938","title":{"rendered":"CVE-2026-92938 [CRITICAL] &#8211; vm2 versions 3.11.3 through 3.11.6 expose Node.js&#8217;s host node:sqlite module to code runnin"},"content":{"rendered":"<p>vm2 versions 3.11.3 through 3.11.6 expose Node.js&#8217;s host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: [&#8216;*&#8217;]. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with &#8216;node:&#8217; as a core-module request and the runtime strips only one &#8216;node:&#8217; prefix, so a sandbox request for &#8216;node:node:sqlite&#8217; resolves to the configured node:sqlite entry. Sandboxed code can therefore create an in-memory DatabaseSync with extension loading enabled and call DatabaseSync.loadExtension() on a native library bundled in the untrusted plugin package (path derived from __dirname). SQLite loads the library into the Node.js host process and invokes its native entry point, giving the sandboxed plugin arbitrary native code execution outside the sandbox with the host process&#8217;s privileges. The issue is fixed in vm2 3.11.7.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>vm2 versions 3.11.3 through 3.11.6 expose Node.js&#8217;s host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: [&#8216;*&#8217;]. The module is wrapped<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25359","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25359","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25359"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25359"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25359"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}