The vulnerability of the tls.setDefaultCACertificates() function in the vm2 package manager NPM allows a attacker to execute arbitrary code.

The vulnerability of the tls.setDefaultCACertificates function in the vm2 package manager’s NPM library is related to the improper assignment of permissions for critical resources. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-92941

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates and replace process-wide certificate authorities. Attackers with access to allowed tls and url builtins can use URLSearchParams to create host-realm...