CVE-2026-92951 — vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name b…
Published: 2026-09-17 · CVSS: 9.4 · CVSS 4.0
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7