cyfenced.com →

[ CVE-2026-92945 · Published 17 Sep 2026 ]

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

CVSS 4.2 EPSS <1%Fix available

[ Description ]Official description

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.

[ Fixes ]Fixes and patches

  • vm2 3.11.7Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.11.7 or later (affected <= 3.11.6)

[ Packages ]Affected open-source packages

[ References ]References