CVE-2026-92951

CRITICAL 9.9

vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

CVSS Score

9.9

EPSS Score

0.0%

EPSS Percentile

0th

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

CWE	CWE-706
Vendor	patriksimek
Product	vm2
Published	Sep 17, 2026

Stay Ahead of the Next One

Get instant alerts for patriksimek vm2

Be the first to know when new critical vulnerabilities affecting patriksimek vm2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Affected Versions

patriksimek / vm2

0 < 3.11.7

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93 vulncheck.com: https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver

Credits

🔍 XlabAITeam 🔍 keenanwgn 🔍 liangjs