by Kastro
Paper/Archive/CVE-2026-92941

CVE-2026-92941

patriksimek vm2 — vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

EPSS 0.3%public exploitCVSS 10.0
critical.is priorityof 100
44
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 21.5.215 × 204.3Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.

Affected

ProductAffectedFixed inSource
vm23.11.3 – < 3.11.73.11.7CNA

Scores by source

VulnCheck (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
VulnCheck (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitgithub.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cmwriteupvulncheck.com/advisories/vm2-3.11.3-before-3.11.7-tls-trust-store-manipulation