CVE-2026-92941
vm2 NodeVM can replace the host process TLS trust store
vm2 3.11.6 exposes the host tls module to a NodeVM when that builtin is explicitly allowed. Although the module object is wrapped as read-only, its functions still execute against process-wide host state. On Node.js versions that provide tls.setDefaultCACertificates(), sandbox code can replace the certificate authorities trusted by subsequent host-realm TLS clients.
- No known exploitation
- Severity
- Critical, CVSS 10.0 (v3.1)
- EPSS
- 0.29% chance of exploitation in 30 days (EPSS, as of Oct 23, 2026)
- Affected packages
- vm2 (npm) >= 3.11.3, <= 3.11.6, fixed in 3.11.7 · GHSA-98xx-8mx4-x7cm