Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-92941 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

CNA: [email protected]CVSS-B:10 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cm	CISA-ADP	AdvisoryExploitRemedyTechnical DescriptionVendor
https://github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cm	[email protected]	AdvisoryExploitRemedyTechnical DescriptionVendor
https://www.vulncheck.com/advisories/vm2-3.11.3-before-3.11.7-tls-trust-store-manipulation	[email protected]	Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-732	Incorrect Permission Assignment for Critical Resource	[email protected]

Affected Products

Product	Versions
vm2	>= 3.11.3, <= 3.11.6 (semver)
CPE cpe:2.3:a:vm2_project:vm2::::::node.js::* Remediation Upgrade: 3.11.7moderate effort

Change History

2 change records found show changes

Date	Action	Recorded By
Sep 17, 2026	CVE Modified	CISA-ADP
Sep 17, 2026	New CVE Received	[email protected]