{"items":[{"id":"NVI-00012956","kind":"vulnerability","title":"Duplicate Advisory: vm2 3.11.6 allows a sandboxed plugin to execute native code through `node:sqlite`","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"withdrawn","identifiers":["GHSA-m7cq-7f2q-f9fh"],"plain_summary":"GitHub lists this reviewed advisory for vm2. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1e1c2a24534dd37cfd4d679a7f503e84"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-01T15:28:57.000Z","value":"9.9 critical","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-1e1c2a24534dd37cfd4d679a7f503e84"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1e1c2a24534dd37cfd4d679a7f503e84","url":"https://github.com/advisories/GHSA-m7cq-7f2q-f9fh","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-m7cq-7f2q-f9fh","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:22:52.960Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1e1c2a24534dd37cfd4d679a7f503e84"],"technology":"vm2","known_exclusions":[],"conditions_summary":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-6w8r-xxw2-g3hx. This link is maintained to preserve external references.\n\n## Original Description\nvm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in addition, the resolver treats any request starting with 'node:' as a core-module request and the runtime strips only one 'node:' prefix, so a sandbox request for 'node:node:sqlite' resolves to the configured node:sqlite entry. Sandboxed code can therefore create an in-memory DatabaseSync with extension loading enabled and call DatabaseSync.loadExtension() on a native library bundled in the untrusted plugin package (path derived from __dirname). SQLite loads the library into the Node.js host process and invokes its native entry point, giving the sandboxed plugin arbitrary native code execution outside the sandbox with the host process's privileges. The issue is fixed in vm2 3.11.7.","public_affected_ranges":[">= 3.11.3, <= 3.11.6"]}],"null_published_at":"2026-11-01T07:29:12.904Z","source_updated_at":"2026-10-01T15:28:57.000Z","source_disclosed_at":"2026-09-17T15:32:14.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:22:52.960Z"}],"next_cursor":null,"snapshot_revision":"42594"}