Skip to content
CVE PROGRAM SOURCE RECORD2.3 Low

CVE-2026-92945

vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

patriksimek vm2

Default version status: unaffected

  • 0 to < 3.11.7affected
  • 3.11.7unaffected
pkg:npm/vm2

References