vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist
    check that uses non-exact substring matching instead of full package-name boundary validation. Attackers
    can bypass the allowlist by requiring a colliding package name that contains an allowlisted package
    substring, causing vm2 to load and execute unauthorized host packages in the host context.
    (CVE-2026-92951)

ID	Name	Product	Family	Type	Severity
473910	SCA: security update for vm2 (GHSA-c48m-32m9-vx93)	Tenable Cloud Security	SCA Checks	Local	critical
473910	SCA: security update for vm2 (GHSA-c48m-32m9-vx93)	Tenable Self-Hosted Container Security	SCA Checks	Local	critical
472276	Echo: vm2: security update to 3.11.7	Tenable Cloud Security	Echo Local Security Checks	Local	critical
472276	Echo: vm2: security update to 3.11.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	critical

Detections

Analytics

CVE-2026-92951

critical

Tenable Plugins

critical

critical

critical

critical