← Back to the live CVE advisory feed

CVE-2026-92938: Product identification pending

Severity

9.4 (CRITICAL)

Vendor

VM2

Affected versions

Through 3.11.6

Patch status

Unknown

Published

2026-09-17T14:17:58.750

Modified

2026-09-17T14:17:58.920

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Prioritize validation immediately due to critical CVSS severity.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Compare installed versions against the affected version range in the advisory.

Technical summary

vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with 'node:' as a core-module request and the runtime strips only one 'node:' prefix, so a sandbox request for 'node:node:sqlite' resolves to the configured node:sqlite entry. Sandboxed code can therefore create an in-memory DatabaseSync with extension loading enabled and call DatabaseSync.loadExtension() on a native library bundled in the untrusted plugin package (path derived from __dirname). SQLite loads the library into the Node.js host process and invokes its native entry point, giving the sandboxed plugin arbitrary native code execution outside the sandbox with the host process's privileges. The issue is fixed in vm2 3.11.7.

View the official NVD record for CVE-2026-92938

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.