CVE-2026-92945: vm2 module allowlist bypass via prefix matching

CVE-2026-92945 · Severity: medium · CVSS 4.2 · Published 2026-09-17

vm2 is a popular Node.js sandbox that restricts code execution by limiting which external modules can be loaded. This vulnerability bypasses those restrictions by exploiting flawed string matching logic—code in an allowlisted module can load a sibling package with a similar name, even though that sibling was never authorized. An attacker could read or modify files and data that should have been restricted by the sandbox.

Technologies: vm2 (npm). Vendors: npm.

Quick answers

Is CVE-2026-92945 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-92945 being exploited in the wild.
How severe is CVE-2026-92945?
Medium severity, with a CVSS score of 4.2, published 17 September 2026.
Which products and versions are affected?
vm2 (npm) <= 3.11.6, SEMVER:introduced=0,fixed=3.11.7.
Is there a fix for CVE-2026-92945?
Yes. vm2 (npm): upgrade to 3.11.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-92945 attacked?
It is attacked over the network.
Am I affected by CVE-2026-92945?
Check whether you run vm2 (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • vm2 (npm): upgrade to 3.11.7 or later
    npm install vm2@3.11.7

Technical details

The vulnerability exists in the isPathAllowedForModule function (lib/resolver-compat.js, lines 122–132), which uses String.startsWith() to verify whether a resolved module path belongs to an allowlisted module. This allows a package like `node_modules/foo2` to pass validation when `node_modules/foo` is allowlisted, because the path prefix matches. An attacker exploits this by performing a relative require from an allowlisted package to reach a non-allowlisted sibling. The attack requires three preconditions: (1) transitive loading must be disabled, (2) the package layout with prefix-sharing names must already exist, and (3) the allowlisted package must have a reachable code path executing the relative require. The fix is to enforce a path separator boundary after the prefix, so only actual subdirectories of an allowlisted module are granted access. Patched in version 3.11.7.

Affected products

  • vm2 vm2 before 3.11.7

Identifiers

  • CVE-2026-92945
  • GHSA-7q3f-wx44-378m

Timeline

  • 2026-08-24: disclosed
  • 2026-09-17: advisory
  • 2026-09-17: patched: Version 3.11.7

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.