CVE-2026-92941

Summary

This flaw allows attackers to replace the process-wide certificate authorities in NodeVM sandbox code, enabling them to accept attacker-controlled certificates. This can lead to unauthorized access to secure communications.

Exploitability

Exploitation is relatively straightforward for attackers with access to allowed tls and url builtins. Precondition is access to these builtins.

Blast radius

If exploited, this can result in unauthorized access to sensitive data and services, compromising the security of the entire system.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to vm2 version 3.11.7 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.