CVE-2026-92951
Last modified
CVE-2026-92951 is a critical-severity vulnerability rated 9.9/10 on the CVSS scale. vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context..
Description
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2026-92951?
How severe is CVE-2026-92951?
How do I fix CVE-2026-92951?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2026
- CVE-2026-92946vm2 before 3.11.7 contains a remote code execution vulnerabi…10
- CVE-2026-92947vm2 before 3.11.7 exposes Node's shared Buffer pool to sandb…10
- CVE-2026-92948vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM…9.9
- CVE-2026-92949vm2 versions from 3.9.6 before 3.11.7 fail to properly restr…4
- CVE-2026-9295A security flaw has been discovered in Edimax BR-6428NS 1.10…8.8
- CVE-2026-92950vm2 before 3.11.7 contains a sandbox escape vulnerability in…8.6
- CVE-2026-92952vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.…6.8
- CVE-2026-92953vm2 versions from 3.11.0 before 3.11.8 fail to protect host …10
- CVE-2026-92954vm2 is a sandbox library for running untrusted JavaScript in…8.6
- CVE-2026-92955vm2 before 3.11.8 contains a sandbox escape vulnerability in…10
- CVE-2026-92956vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape …10
- CVE-2026-92957vm2 through 3.11.6 does not normalize `node:`-prefixed built…9.9
Are you affected by CVE-2026-92951?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST