cyfenced.com →

[ CVE-2026-92951 · Published 17 Sep 2026 ]

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

CVSS 9.9 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Critical severity: CVSS 9.9

[ Description ]Official description

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

[ Fixes ]Fixes and patches

  • vm2 3.11.7Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.11.7 or later (affected <= 3.11.6)

[ Packages ]Affected open-source packages

[ References ]References