CVE-2026-92941: vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
vm2to a version that resolves this vulnerability.Fixed in 3.11.7
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using vm2 versions 3.11.3 through versions before 3.11.7 are exposed when NodeVM sandbox code is allowed to access both the tls and url builtins. The issue affects the process-wide TLS trust store, not only the individual sandbox.
What access does an attacker need?
An attacker needs the ability to run code in a NodeVM sandbox where the tls and url builtins are allowed. No privileges or user interaction are required according to the supplied vector.
What is the practical impact after exploitation?
An attacker can replace the process-wide certificate authorities using tls.setDefaultCACertificates(). Subsequent HTTPS clients running in the host process may then accept attacker-controlled certificates.