CVE-2026-92941

Critical

Description

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.

SeverityCritical

CVSS10.0

Exploit probability—

ProductVm2

PublishedSep 17, 2026

First seenSep 17, 2026

Weakness typeCWE-732CWE-732

How to fix

Update

vm23.11.7 or later

Vendor advisories

github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cm

Affected products

Product	Affected versions	Fixed in
vm2npm	3.11.3 ≤ v < 3.11.7	3.11.7

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.