Bug 2536029 (CVE-2026-92945) - CVE-2026-92945 vm2: vm2: Module allowlist bypass allows access to restricted packages
Summary: CVE-2026-92945 vm2: vm2: Module allowlist bypass allows access to restricted ...
Keywords:
Status: NEW
Alias: CVE-2026-92945
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-17 13:58 UTC by OSIDB Bzimport
Modified: 2026-09-17 18:45 UTC (History)
15 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-17 13:58:02 UTC 
vm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of boundary-anchored comparison. Attackers can reach non-allowlisted packages sharing a prefix with allowlisted modules by performing relative requires from allowlisted packages when transitive loading is disabled.
Note You need to log in before you can comment on or make changes to this bug.