CVE-2026-92941

{
  "etk_id": "ETK-2026-251",
  "cve_id": "CVE-2026-92941",
  "display_id": "CVE-2026-92941",
  "ghsa_id": "GHSA-98xx-8mx4-x7cm",
  "euvd_id": "EUVD-2026-81591",
  "status": "published",
  "anchor_state": "anchored",
  "title": "TLS trust-store sandbox escape in vm2",
  "summary": "vm2 before 3.11.7 can let untrusted NodeVM code alter the host process's default TLS certificate authorities. An attacker must be able to execute sandboxed code with the tls and url built-ins enabled; subsequent host TLS clients may then trust attacker-controlled certificates or experience connection failures.",
  "mitigation": "Upgrade vm2 to version 3.11.7. Until upgrading, do not allow the tls or url built-ins in NodeVM instances that execute untrusted code.",
  "vendor": "npm",
  "product": "npm:vm2",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 3.11.3, <= 3.11.6"
      ],
      "ecosystem": "npm",
      "fixed_versions": [
        "3.11.7"
      ],
      "package_name": "vm2",
      "purl": "pkg:npm/vm2"
    }
  ],
  "cwes": null,
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L",
  "epss_score": 0.0029,
  "epss_percentile": 0.2019,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 15.376113983333333,
  "t0_at": "2026-09-17T13:46:04.885000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-17T13:46:04.885000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-09-17T13:46:04.885000+00:00",
      "url": "https://github.com/advisories/GHSA-98xx-8mx4-x7cm"
    }
  }
}