CVE-2026-92945

vm2 before 3.11.7 contains a module allowlist bypass in the isPathAllowedForModule function. The root cause is the use of raw string prefix matching instead of a boundary-anchored comparison, allowing attackers to reach non-allowlisted packages that share a name prefix with an allowlisted module....