Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
GHSA-7q3f-wx44-378m affects the npm package vm2 in versions before 3.11.7. An external module allowlist check uses a plain string prefix test, so a package whose name shares a prefix with an allowlisted package (for example foo2 alongside foo) can be treated as allowlisted. An attacker would need code running in NodeVM under such an allowlist with transitive loading disabled, plus an allowlisted package that performs a relative require to the sibling, and could then reach a package that was not allowlisted. The fix is in 3.11.7, so upgrade vm2 to that version.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 2.3 | Low | 4.0 | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N | CNA (VulnCheck) |
- CISA KEV Not listed.
- EPSS 0.0028, the 20th percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:34 UTC First seen by agentprime
- 31 Oct 2026, 13:34 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-7q3f-wx44-378m
- OSV: GHSA-7q3f-wx44-378m
- github.com/patriksimek/vm2/security/advisories/GHSA-7q3f-wx44-378m
- nvd.nist.gov/vuln/detail/CVE-2026-92945
- github.com/patriksimek/vm2/commit/6ac3916da84e060c403e407b6b6318fcc66b0e72
- github.com/patriksimek/vm2
- github.com/patriksimek/vm2/releases/tag/v3.11.7
- www.vulncheck.com/advisories/vm2-before-3.11.7-module-allowlist-bypass-via-prefix-matching