CVE-2026-92941 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
Attackers can manipulate the TLS trust store in vm2 sandboxes, allowing host HTTPS clients to accept malicious certificates and bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-92941?
CVE-2026-92941 is a critical vulnerability in patriksimek vm2, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.
Weakness: CWE-732
Which versions are affected by CVE-2026-92941?
2 open source packages ship an affected version, including vm2.
| Package | Affected | Fixed in |
|---|---|---|
vm2 npm | From 3.11.3 | 3.11.7 |
vm2 npm | From 3.11.3 | 3.11.7 |
How do I fix CVE-2026-92941?
Upgrade vm2 to 3.11.7 or later.
Is CVE-2026-92941 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-92941 exists.
Sources
Also known as CLEANSTART-2026-BS07911, ECHO-306b-24c3-45bd, GHSA-98xx-8mx4-x7cm, MINI-hgc2-9c39-75cq, ROOT-APP-NPM-CVE-2026-92941.