CVE-2026-118682

EUVD-2026-112489
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.5 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/KaringX/clashmi
https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/auto_update_manager.dart#L293
https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/setting_manager.dart#L225
https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/utils/http_utils.dart#L674-L676
https://github.com/KaringX/clashmi/issues/605
https://www.vulncheck.com/advisories/clashmi-through-1.0.32.1801-disabled-tls-certificate-validation-enables-update-mitm