In patriksimek vm2 versions 3.11.3 through 3.11.6, the Node.js builtin module node:sqlite is exposed to sandboxed code running in NodeVM when builtin modules are permitted. The module is wrapped with vm.readonly(), preventing property assignment but leaving callable host functions accessible. The module resolver treats requests starting with 'node:' as core modules and strips only one 'node:' prefix, allowing a sandboxed request for 'node:node:sqlite' to resolve to the node:sqlite module. This enables sandboxed code to create an in-memory DatabaseSync with extension loading enabled and call DatabaseSync.loadExtension() on a native library bundled in the untrusted plugin package. As a result, SQLite loads the native library into the host Node.js process and executes its native entry point, granting arbitrary native code execution outside the sandbox with host privileges. The issue is resolved in vm2 version 3.11.7.

Sandboxed code can bypass vm2's isolation and execute arbitrary native code within the host Node.js process, potentially leading to full compromise of the host environment with the privileges of the Node.js process. This represents a critical security risk for applications relying on vm2 for sandboxing untrusted code.

Upgrade vm2 to version 3.11.7 or later, where this vulnerability is fixed. No other mitigations are indicated. Patch status is confirmed by the vendor advisory stating the fix is in 3.11.7.