CVE-2026-92951 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-92951?
CVE-2026-92951 is a critical vulnerability in patriksimek vm2, published on 17 Sep 2026.
Official description
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.
Weakness: CWE-706
Which versions are affected by CVE-2026-92951?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | All versions | 3.11.7 |
vm2 npm | All versions | 3.11.7 |
How do I fix CVE-2026-92951?
Upgrade vm2 to 3.11.7 or later.
Is CVE-2026-92951 being exploited?
There is no known exploitation of CVE-2026-92951 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-SU19502, ECHO-cf9b-87ca-645c, GHSA-c48m-32m9-vx93, MINI-7rqq-v3xg-f355, ROOT-APP-NPM-CVE-2026-92951.