CVE-2026-92951 in vm2
Zusammenfassung
von MITRE • 17.09.2026
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.