CVE-2026-92951
CVE-2026-92951 · vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.
CVSS 9.4 · Critique · EPSS 0,5% · Code d’exploitation public · Correctif disponible
- Publication
- Mise à jour
Pile logicielle: node