CVE-2026-92938

vm2 (a Node.js sandboxing library) versions 3.11.3 through 3.11.6 are vulnerable to Remote Code Execution via the node:sqlite module. When the module is permitted (explicitly or via builtin: ['*']), it is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority cal...