p PatchFirst

CVE-2026-92951

CVE-2026-92951 · vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

This page contains facts from public vulnerability sources. Check the original advisory before updating.

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

CVSS 9.4 · Critical · EPSS 0.5% · Public exploit · Fix available

Published
Updated

Stack: node

Affected products and versions

  • vm2

    Versions
    • ≥ 0, < 3.11.7: Affected (semver)
    • 3.11.7: Not affected (semver)

    Update to 3.11.7

  • vm2 npm

    Affected ranges
    • SEMVER: < 3.11.7

    Update to 3.11.7

Original sources

Check your server →