Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

GHSA-8MVV-MCC3-XWHH Duplicate Advisory: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass in the isPathAllowedForModule function. The root cause is the use of raw string prefix matching instead of a boundary-anchored comparison, allowing attackers to reach non-allowlisted packages that share a name prefix with an allowlisted module....

CVE-2026-92945: Improper Limitation of a Pathname to a Restricted Directory

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from...

PT-2026-105498

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-7q3f-wx44-378m. This link is maintained to preserve external references. Original Description vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string...

PT-2026-94316

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.7 Description A module allowlist bypass exists in the isPathAllowedForModule function. The issue stems from the use of raw string prefix matching instead of boundary-anchored comparison. This allows attackers to acce...