Duplicate Advisory: vm2 NodeVM can replace the host process TLS trust store

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-98xx-8mx4-x7cm. This link is maintained to preserve external references. Original Description vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call...

PT-2026-94313

Name of the Vulnerable Software and Affected Versions vm2 versions 3.11.3 through 3.11.6 Description The host tls module is exposed to NodeVM sandbox code, which allows attackers to call the setDefaultCACertificates function and replace process-wide certificate authorities. By utilizing allowed t...