cyfenced.com →

[ CVE-2026-92941 · Published 17 Sep 2026 ]

vm2 NodeVM can replace the host process TLS trust store

CVSS 10.0 EPSS <1%Fix available

[ Why it matters ]Priority signals

  • Public proof-of-concept exploit exists (CISA SSVC)
  • Critical severity: CVSS 10.0

[ Description ]Official description

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.

[ Fixes ]Fixes and patches

  • vm2 3.11.7Fixed version · GitHub Advisories · npm package vm2: upgrade to 3.11.7 or later (affected >= 3.11.3, <= 3.11.6)

[ Packages ]Affected open-source packages

[ References ]References