vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-92951 · CVE overview and exploitation status

EUVD-2026-81600

GHSA-6fvh-fgmg-3x7v

GHSA-c48m-32m9-vx93

cve-program · CVE-2026-92951

• https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver

euvd · EUVD-2026-81600

• https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver

nvd · CVE-2026-92951

• https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver

osv · GHSA-6fvh-fgmg-3x7v

• https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93
• https://nvd.nist.gov/vuln/detail/CVE-2026-92951
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver

osv · GHSA-c48m-32m9-vx93

• https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93
• https://nvd.nist.gov/vuln/detail/CVE-2026-92951
• https://github.com/patriksimek/vm2/commit/ab4ee7d803e8c80155e9eb3672226bddbca4aa9c
• https://github.com/patriksimek/vm2
• https://github.com/patriksimek/vm2/releases/tag/v3.11.7
• https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver

• vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requi… · Advisory content revised · 1 Nov 2026