CVE-2026-92951

Name of the Vulnerable Software and Affected Versions vm2 versions prior to 3.11.7

Description An incorrect authorization issue exists in the external package allowlist check. The system uses non-exact substring matching instead of full package-name boundary validation. This allows attackers to bypass the allowlist by requesting a colliding package name that contains a substring of an allowed package, leading to the loading and execution of unauthorized host packages within the host context.

Recommendations Update to version 3.11.7 or later.