CVE-2026-92938: vm2 Package Allows Arbitrary Native Code Execution via node:sqlite
Summary
CVE-2026-92938: vm2 allows a sandboxed plugin to execute native code through node:sqlite. Affects vm2 versions >= 3.11.3, < 3.11.7. Fixed in 3.11.7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The vm2 package is a popular Node.js library that provides a sandboxed environment for executing untrusted JavaScript code. It allows developers to run code securely by isolating it from the host environment. However, a critical vulnerability has been identified in version 3.11.6, which exposes the host's node:sqlite module to untrusted code, enabling potential exploitation.
Vulnerability Detail
The vulnerability arises from the exposure of the node:sqlite module within the vm2 sandbox when explicitly allowed or through wildcard configurations. Although the module is wrapped as read-only, it retains callable methods that can execute native code. An attacker can leverage this by supplying a plugin with a native library, allowing arbitrary code execution within the Node.js host process. This poses severe risks, including unauthorized access to sensitive data, modification of application files, and the ability to perform any action permitted to the host account.
How To Fix
Latest published version: 3.12.2 as of 22 Oct 2026
npm install vm2@3.12.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.11.7
This is the first release that contains the fix.
npm install vm2@3.11.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid allowing the node:sqlite module in your vm2 configuration. Instead, restrict the built-in modules to only those that are absolutely necessary for your application. Here is an example of how to configure vm2 without the vulnerable module:
const { NodeVM } = require('vm2');
const vm = new NodeVM({
console: 'off',
require: { builtin: [] },
});
Conclusion
In summary, the vm2 package has a critical vulnerability (CVE-2026-92938) that allows arbitrary native code execution through the node:sqlite module. It is essential to update to version 3.11.7 or later to mitigate this risk. If immediate updates are not feasible, apply the recommended workaround to enhance security.
See every vulnerability recorded for vm2 →
FAQ
The CVSS score of this vulnerability is 9.9, indicating a critical level of severity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The potential impacts include unauthorized access to sensitive data, modification of application files, and the ability to execute arbitrary code with the host's privileges.
Yes, you can mitigate the vulnerability by avoiding the use of the node:sqlite module in your vm2 configuration and restricting built-in modules.
If you cannot update the package immediately, implement the workaround by configuring vm2 to exclude the node:sqlite module and review your code for any potential exposure to untrusted plugins.
References
Related vulnerabilities
Recent vulnerabilities recorded for vm2.
