https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T11:35:11.999051+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-92945 CVE-2026-92945 — vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching 2026-09-29T11:35:12.048179+00:00

Affected: patriksimek vm2

vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.