CVE-2026-92951CWE-706

CVE-2026-92951

Critical · published September 17, 2026

CVSS v3.1
9.9
EPSS
1%
Percentile
44.6
In the wild
Unconfirmed
What it is

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
9.4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00539 · 44.6th percentile
Weakness
CWE-706 · Use of Incorrectly-Resolved Name or Reference
Published
2026-09-17T18:18Z
References (2)
https://github.com/patriksimek/vm2/security/advisories/GHSA-c48m-32m9-vx93 · [email protected]https://www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-custom-resolver · [email protected]
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 13:46Z
    vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver
    cvelistv5