NPM: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

🗓️ 01 Oct 2026 15:37:19Reported by PatchstackType

patchstack🔗 patchstack.com👁 3 Views

vm2 custom module resolver allows bypassing the external package allowlist.

Reporter	Title	Published	Views	Family All 14
BDU FSTEC	The vulnerability of the NPM package manager vm2 library, related to the use of a name with an incorrect reference, allows attackers to execute arbitrary code.	21 Sep 202600:00	–	bdu_fstec
Circl	CVE-2026-92951	17 Sep 202616:10	–	circl
CVE	CVE-2026-92951	17 Sep 202613:46	–	cve
Cvelist	CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver	17 Sep 202613:46	–	cvelist
EUVD	EUVD-2026-81600	1 Oct 202615:37	–	euvd
Github Security Blog	Duplicate Advisory: vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package	17 Sep 202615:32	–	github
Github Security Blog	vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package	1 Oct 202615:37	–	github
NVD	CVE-2026-92951	17 Sep 202614:18	–	nvd
OSV	GHSA-C48M-32M9-VX93 vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package	1 Oct 202615:37	–	osv
Positive Technologies	PT-2026-94322	25 Aug 202600:00	–	ptsecurity

Vulners

Node

npm vm2Range≤3.11.6

Source	Link
github	www.github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-92951
github	www.github.com/patriksimek/vm2/commit/ab4ee7d803e8c80155e9eb3672226bddbca4aa9c
github	www.github.com/patriksimek/vm2/releases/tag/v3.11.7
vulncheck	www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver
github	www.github.com/advisories/GHSA-c48m-32m9-vx93

01 Oct 2026 15:37Current

5.9Medium risk

Vulners AI Score5.9

CVSS 49.4

CVSS 3.19.9

EPSS0.00539

SSVC

vm2 custom module resolver allowlist bypass host package loading