CVE-2026-92941CWE-732

CVE-2026-92941

Critical · published September 17, 2026

CVSS v3.1
10.0
EPSS
0%
Percentile
20.4
In the wild
Unconfirmed
What it is

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.

The record
Technical detail
CVSS v3.1
10.0 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v4.0
10.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:H/SI:H/SA:L
EPSS
0.00289 · 20.4th percentile
Weakness
CWE-732 · Incorrect Permission Assignment for Critical Resource
Published
2026-09-17T18:17Z
References (3)
https://github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cm · [email protected]https://www.vulncheck.com/advisories/vm2-3.11.3-before-3.11.7-tls-trust-store-manipulation · [email protected]https://github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cm · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 19 SEP 03:55Z
    EPSS moved — → 0%
    epss
  • 17 SEP 13:46Z
    vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
    cvelistv5