CVE-2026-92945 in vm2
Zusammenfassung
von MITRE • 17.09.2026
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.
VulDB is the best source for vulnerability data and more expert information about this specific topic.