CVE-2026-118682: high-severity vulnerability in KaringX clashmi
ClashMi through 1.0.32.1801 Disabled TLS Certificate Validation Enables Update MITM
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.7epss 0.3%
KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing attackers to intercept HTTPS traffic by presenting any certificate. Attackers operating the user's proxy node can serve a forged update manifest omitting sha256 to deliver a malicious installer, achieving code execution when the update runs.
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
KaringX · clashmiReferences
https://github.com/KaringX/clashmihttps://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/auto_update_manager.dart#L293https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/modules/setting_manager.dart#L225https://github.com/KaringX/clashmi/blob/v1.0.32.1801/lib/app/utils/http_utils.dart#L674-L676https://github.com/KaringX/clashmi/issues/605https://www.vulncheck.com/advisories/clashmi-through-1.0.32.1801-disabled-tls-certificate-validation-enables-update-mitm