CVE-2026-92958: Javascript Vm2 Builtin Denylist Exact Name Subpath Bypass
Incomplete builtin denylist: the '*' wildcard expansion allow-gates each builtin with an exact-name deny test only (`-name` / `-node:name`). Node lists families and subpaths as separate builtinModules entries (`fs` vs `fs/promises`, `path` vs `path/posix`, `stream` vs `stream/web`), so a family token such as `-fs` removes only `fs` and leaves the real host `
JSgreprules fetch cve-2026-92958-javascript-vm2-builtin-denylist-exact-name-subpath-bypass --engine opengrepDescription
Incomplete builtin denylist: the '*' wildcard expansion allow-gates each builtin with an exact-name deny test only (`-name` / `-node:name`). Node lists families and subpaths as separate builtinModules entries (`fs` vs `fs/promises`, `path` vs `path/posix`, `stream` vs `stream/web`), so a family token such as `-fs` removes only `fs` and leaves the real host `
Community feedback
0 rule-level signals from signed-in users.
- Useful reports
- 0
- Context false positives
- 0
- Metadata suggestions
- 0
Contextual precision
Aggregated from approved scan feedback. False-positive reports describe observed scan contexts, not a global rule verdict.
- Findings observed
- 0
- Projects
- 0
- Reporters
- 0
Precision details are collecting more signed-in reports before verdict counts or ratios are emphasized.
No approved finding verdicts yet.
No scan diagnostics reported yet.