Critical severity10.0NVD Advisory· Published Sep 17, 2026· Updated Sep 17, 2026
CVE-2026-92941
CVE-2026-92941
Description
vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm arrays and manipulate the TLS trust store, enabling subsequent host HTTPS clients to accept attacker-controlled certificates.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
vm2npm | >= 3.11.3, < 3.11.7 | 3.11.7 |
Affected products
2- Range: >=3.11.3,<3.11.7
Patches
Vulnerability mechanics
References
6- github.com/advisories/GHSA-98xx-8mx4-x7cmghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-92941ghsaADVISORY
- github.com/patriksimek/vm2/commit/aa146a77f859325e079f3bfbfe6d8309af483daaghsaWEB
- github.com/patriksimek/vm2/releases/tag/v3.11.7ghsaWEB
- github.com/patriksimek/vm2/security/advisories/GHSA-98xx-8mx4-x7cmnvdWEB
- www.vulncheck.com/advisories/vm2-3.11.3-before-3.11.7-tls-trust-store-manipulationnvdWEB
News mentions
1- vm2 npm Package: 25 Critical Sandbox Escape Vulnerabilities Disclosed TogetherVypr Intelligence · Sep 18, 2026