CVE-2026-92945: vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

isPathAllowedForModule decides whether a resolved path belongs to an allowlisted external module using a raw string prefix test. node_modules/foo2 starts with node_modules/foo, so a package whose name merely shares a prefix with an allowlisted one is treated as being inside it, and a relative require from the allowlisted package reaches it even with transitive loading disabled.