CVE-2026-92951: Patriksimek VM2

Critical severity, CVSS 9.9. EPSS: 0.5% chance of exploitation in the next 30 days.

vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of full package-name boundary validation. Attackers can bypass the allowlist by requiring a colliding package name that contains an allowlisted package substring, causing vm2 to load and execute unauthorized host packages in the host context.

Affected products

• Patriksimek VM2: before 3.11.7 (fixed in 3.11.7)

Published 2026-09-17. Last modified 2026-09-17.