Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

🗓️ 17 Sep 2026 15:32:15Reported by GitHub Advisory DatabaseType

Module allowlist bypass in vm2 via raw prefix matching in isPathAllowedForModule.

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability of the isPathAllowedForModule function in the vm2 library of the NPM package manager allows a perpetrator to gain unauthorized access to protected information.	22 Sep 202600:00	–	bdu_fstec
CVE	CVE-2026-92945	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81594	1 Oct 202615:26	–	euvd
Github Security Blog	vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted	1 Oct 202615:26	–	github
NVD	CVE-2026-92945	17 Sep 202614:17	–	nvd
OSV	CLSA-2026-1790888247 TuxCare security update for vm2 (15 CVEs)	1 Oct 202620:57	–	osv
OSV	GHSA-7Q3F-WX44-378M vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted	1 Oct 202615:26	–	osv
Patchstack	NPM: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted	1 Oct 202615:26	–	patchstack
Positive Technologies	PT-2026-94316	25 Aug 202600:00	–	ptsecurity

Vulners

Node

vm2_project vm2Range≤3.11.6npm

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-7q3f-wx44-378m
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92945
vulncheck	www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-prefix-matching
github	www.github.com/advisories/GHSA-8mvv-mcc3-xwhh

01 Oct 2026 15:26Current

5.8Medium risk

Vulners AI Score5.8

CVSS 42.3

CVSS 3.14.2

EPSS0.00277

SSVC