EUVD-2026-81588

vm2 allows a sandboxed plugin to execute native code through node:sqlite...

CVE-2026-92938

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...