Remote Code Execution Vulnerability in vm2 Affects Node.js Applications
CVE-2026-92938

9.4CRITICAL

Key Information:

Vendor

Patriksimek

Status
Vm2
Vendor
CVE Published:
17 September 2026

What is CVE-2026-92938?

The vm2 library introduces a significant vulnerability in versions 3.11.3 through 3.11.6, allowing code within a NodeVM to access the host Node.js's node:sqlite module. With the appropriate permissions, this access can permit sandboxed code to execute native libraries from untrusted plugin packages, effectively allowing for arbitrary code execution with the host’s privileges. This is a serious threat, as it undermines the integrity of the sandbox, by providing an exploit vector that can bypass security mechanisms intended to isolate potentially harmful operations.

Affected Version(s)

vm2 3.11.3 < 3.11.7

vm2 3.11.7

References

https://github.com/patriksimek/vm2/security/advisories/GH...
vendor-advisory
https://www.vulncheck.com/advisories/vm2-3.11.3-through-3...
third-party-advisory

CVSS V4

Score:
9.4
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Forrof
.