The vulnerability is an incorrect authorization flaw in vm2’s external package allowlist. The check uses non-exact substring matching instead of full package-name boundary validation, allowing an attacker to supply a colliding package name that contains an allowlisted substring. This lets the attacker cause vm2 to load and execute an unauthorized host package in the host context, providing unrestricted execution of arbitrary code.

All releases of vm2 managed by patriksimek prior to version 3.11.7 are vulnerable. The impacted component is the module allowlist. Upgrading to version 3.11.7, the first non‑vulnerable release, mitigates the issue.

The CVSS score is 9.4, indicating critical severity. The EPSS score is not available, so the current exploitation probability is unknown; the vulnerability has not been listed in CISA KEV. Based on the description, the attack vector likely requires an attacker to influence the package resolver that vm2 uses to resolve a specially crafted package name containing an allowlisted substring. Once resolved, vm2 will load that package and execute it with host process privileges, effectively giving the attacker full host compromise.