CVE-2026-92938

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

EUVD-2026-81588

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92938 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ''. The module is wrapped with vm.readonly, which prevents property assignment but leaves host-authority callables reachable;...

CVE-2026-92938

vm2 (a Node.js sandboxing library) versions 3.11.3 through 3.11.6 are vulnerable to Remote Code Execution via the node:sqlite module. When the module is permitted (explicitly or via builtin: ['*']), it is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority cal...

BIT-NODE-MIN-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

PT-2026-73399

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3 reset directly, bypassing the...

PT-2026-73409

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3 reset directly, bypassing the...

K000162920: Node.js vulnerability CVE-2026-58041

Security Advisory Description A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

CVE-2026-58041

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application. Mitigation Applicatio...

CVE-2026-58041

A flaw in Node.js node:sqlite allows a stale StatementSyncIterator created through DatabaseSynccreateTagStore to continue executing a cached prepared statement after it has been reset and rebound with new parameters. SQLTagStore resets cached statements using sqlite3reset directly, bypassing the...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...

nodejs: Node.js node:sqlite: Unintended data modification due to stale statement iterator

A flaw was found in Node.js's node:sqlite module. This vulnerability allows a previously used database statement, which should have been reset, to be re-executed with new parameters. This could lead to unintended data modifications or integrity issues within the application...