CVE-2026-92945

A flaw was found in vm2. This vulnerability allows an attacker to bypass the module allowlist, a security feature designed to restrict access to certain software modules. The flaw occurs due to an incorrect string comparison method used in the isPathAllowedForModule function. By exploiting this, ...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

EUVD-2026-81594

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass in the isPathAllowedForModule function. The root cause is the use of raw string prefix matching instead of a boundary-anchored comparison, allowing attackers to reach non-allowlisted packages that share a name prefix with an allowlisted module....