CVE-2026-92941— vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
Quick assessment
Affected
patriksimek vm2
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
vm2 在 3.11.3 及以上、3.11.7 之前版本存在安全漏洞，该漏洞会将宿主机（host）的 tls 模块暴露给 NodeVM 沙箱代码。攻击者因此可以调用 tls.setDefaultCACertificates() 函数，从而替换整个进程范围内的证书颁发机构（CA）。对于能够访问已允许的 tls 和 url 内置模块的攻击者而言，他们可以利用 URLSearchParams 在宿主域（host-realm）中构造数组，进而操纵 TLS 信任存储（trust store），使得后续的宿主 HTTPS 客户
Possible ATT&CK Techniques 3 AI
T1557 · Adversary-in-the-Middle T1567 · Exfiltration Over Web Service T1592 · Gather Victim Host Information
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-92941
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
Source: CVE Program / CVE List V5
Vulnerability Description
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
关键资源的不正确权限授予
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| patriksimek | vm2 | 3.11.3 ~ 3.11.7 | - |
|
II. Public POCs for CVE-2026-92941
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-92941
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-92941 (2)
-
-
🔗 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation | Advisories | VulnCheck third-party-advisory
Same Patch Batch · patriksimek · 2026-09-17 · 30 CVEs total
| CVE-2026-92947 | 10.0 CRITICAL | vm2 before 3.11.7 Memory Disclosure via Buffer Pool |
| CVE-2026-92960 | 10.0 CRITICAL | vm2 before 3.11.6 Process-wide State Exposure via os and dns |
| CVE-2026-92940 | 10.0 CRITICAL | vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent |
| CVE-2026-92937 | 10.0 CRITICAL | vm2 3.11.6 Remote Code Execution via Promise call/apply |
| CVE-2026-92946 | 10.0 CRITICAL | vm2 before 3.11.7 Remote Code Execution via require.external |
| CVE-2026-92956 | 10.0 CRITICAL | vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming |
| CVE-2026-92953 | 10.0 CRITICAL | vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray |
| CVE-2026-92955 | 10.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape via NodeVM |
| CVE-2026-92957 | 9.9 CRITICAL | vm2 before 3.11.7 Authentication Bypass via node: Prefix |
| CVE-2026-92948 | 9.9 CRITICAL | vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test |
| CVE-2026-92939 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine |
| CVE-2026-92938 | 9.9 CRITICAL | vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite |
| CVE-2026-92951 | 9.9 CRITICAL | vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver |
| CVE-2026-92944 | 9.8 CRITICAL | vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector |
| CVE-2026-92935 | 9.0 CRITICAL | vm2 NodeVM Remote Code Execution via Array-Shaped Require |
| CVE-2026-92934 | 9.0 CRITICAL | vm2 before 3.11.8 Sandbox Escape RCE via AggregateError |
| CVE-2026-92954 | 8.6 HIGH | vm2 3.10.0 through 3.11.5 Denial of Service via Host Promise |
| CVE-2026-92950 | 8.6 HIGH | vm2 before 3.11.7 Sandbox Escape via CLI require |
| CVE-2026-92958 | 8.5 HIGH | vm2 before 3.11.7 Denylist Bypass via fs/promises |
| CVE-2026-92942 | 7.5 HIGH | vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry |
Showing top 20 of 30 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: vm2
-
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand -
CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit -
CVE-2026-92960
vm2 before 3.11.6 Process-wide State Exposure via os and dns -
CVE-2026-92959
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
Same vendor: patriksimek
-
CVE-2026-92963
vm2 before 3.11.2 Information Disclosure via Internal State -
CVE-2026-92962
vm2 before 3.11.4 Defense Invariant Violation via setup-sand -
CVE-2026-92961
vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit -
CVE-2026-92960
vm2 before 3.11.6 Process-wide State Exposure via os and dns -
CVE-2026-92959
vm2 before 3.11.8 allowAsync Bypass via Promise Thenable
Same weakness: CWE-732
-
CVE-2026-76104
Dell ObjectScale <4.4.0.0 权限分配错误致DoS -
CVE-2026-76159
Duplicati for Windows - Incorrect Permission Assignment for -
CVE-2026-54447
garminconnect: Insecure Permission Assignment for Garmin OAu -
CVE-2024-58383
Froxlor before 2.2.0 Insecure File Permissions mysql.conf -
CVE-2026-87988
Mistral AI Mistral Vibe 权限许可和访问控制问题漏洞
V. Comments for CVE-2026-92941
No comments yet