CVE-2026-92945: vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7 - Configuration
Ensure vm2's isPathAllowedForModule uses boundary-anchored comparison (not raw string prefix matching) so prefixes cannot bypass the module allowlist.
vm2 module allowlist path matching = boundary-anchored comparison instead of raw string prefix matching
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using vm2 versions before 3.11.7 are exposed when they use a module allowlist with transitive loading disabled. Exploitation also depends on a non-allowlisted package sharing a prefix with an allowlisted module.
What does an attacker need to exploit the bypass?
The attacker needs to perform relative requires from an allowlisted package. The bypass relies on reaching a non-allowlisted package whose name shares a raw string prefix with an allowlisted module.
How can I determine whether my configuration is at risk?
Check whether vm2 is earlier than 3.11.7, whether transitive loading is disabled, and whether your allowlisted module names have non-allowlisted packages sharing their prefixes. Configurations meeting all of these conditions are affected.