CVE-2026-92951
CRITICAL
NVD
CVSS Score
9.9
Severity
CRITICAL
Published
Sep 17, 2026
Vendor
unknown
Description
vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.