CVE-2026-92945 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching
Attackers can bypass module allowlists in vm2 to load unauthorized packages, potentially leading to code execution within the sandbox.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92945?
CVE-2026-92945 is a low-severity path traversal vulnerability in patriksimek vm2, published on 17 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.
Weakness: CWE-22
Which versions are affected by CVE-2026-92945?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | All versions | 3.11.7 |
vm2 npm | All versions | 3.11.7 |
How do I fix CVE-2026-92945?
Upgrade vm2 to 3.11.7 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-92945 being exploited?
There is no known exploitation of CVE-2026-92945 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-WB52901, ECHO-8846-7fbc-2389, GHSA-7q3f-wx44-378m, MINI-6843-ch4f-rg4r.