Detections
Analytics

Echo: vm2: security update to 3.11.7

critical Tenable Cloud Security Plugin ID 472272

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when
 that builtin is permitted, either explicitly or through builtin: ['*']. The module is wrapped with
 vm.readonly(), which prevents property assignment but leaves host-authority callables reachable; in
 addition, the resolver treats any request starting with 'node:' as a core-module request and the runtime
 strips only one 'node:' prefix, so a sandbox request for 'node:node:sqlite' resolves to the configured
 node:sqlite entry. Sandboxed code can therefore create an in-memory DatabaseSync with extension loading
 enabled and call DatabaseSync.loadExtension() on a native library bundled in the untrusted plugin package
 (path derived from __dirname). SQLite loads the library into the Node.js host process and invokes its
 native entry point, giving the sandboxed plugin arbitrary native code execution outside the sandbox with
 the host process's privileges. The issue is fixed in vm2 3.11.7. (CVE-2026-92938)

Solution

Update the vm2 library and its related packages to version 3.11.7 or later.

See Also

https://advisory.echohq.com/cve/CVE-2026-92938

Plugin Details

Severity: Critical

ID: 472272

Version: Revision 1.1

Type: Local

Published: 10/3/2026

Updated: 10/3/2026

Risk Information

VPR

Risk Factor: Medium

Score: 5

Percentile: 93.31

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 6.7

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2026-92938

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 8.6

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Critical

Base Score: 9.4

Threat Score: 7.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/3/2026

Vulnerability Publication Date: 9/17/2026

Reference Information

CVE: CVE-2026-92938