ClashMi EUVD-2026-112489

Exploitation requires the attacker to occupy the victim's HTTPS path for the update request - realistically achieved by operating (or MITM-ing) the proxy node the ClashMi user routes traffic through, which a proxy client inherently exposes. Because TLS certificate validation is disabled by default in the HttpUtils helper, no special victim-side configuration is needed and any forged certificate is accepted. Code execution is reached only when the auto-update flow actually runs and processes a forged manifest that omits the sha256 integrity field. Limiting factors: the attacker must be in the network/proxy path for the update traffic (AT:P), the update process must execute (UI:P, passive user interaction), and impact is confined to users who enable/trigger the auto-update path through an untrusted node.

Signals are moderate and internally consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:P, score 7.7 High) encodes a network-reachable, unauthenticated flaw that nonetheless carries a real attack requirement (AT:P) and passive user interaction (UI:P) - the attacker must already sit in the victim's HTTPS path and an update must run. That path requirement is unusually easy to satisfy here precisely because the product is a proxy/VPN client: whoever operates the proxy node the victim routes through is inherently in a man-in-the-middle position, which is the exact threat model the description names. There is no CISA KEV listing and no EPSS score in the supplied data, and no public exploit is identified at time of analysis, so this is not confirmed active exploitation - the VulnCheck advisory and GitHub issue document the defect (CWE-295, TLS validation disabled by default in HttpUtils) and the exact source lines, not a weaponized exploit. The vuln.today decision label is 'this_week', consistent with a credible, high-impact code-execution path that is not an emergency. Net: a genuine, verifiable code-execution risk for users routing traffic through untrusted proxy nodes, tempered by low product prevalence and the absence of exploitation evidence, rather than a high-CVSS-but-hollow issue. Missing data to note explicitly: no EPSS, no KEV, and no fixed version is listed in the evidence.

A victim runs ClashMi and routes traffic through a proxy node operated by the attacker (or one the attacker can MITM). Because TLS certificate validation is disabled by default, the attacker presents any certificate and serves a forged auto-update manifest that omits the sha256 field, bypassing integrity checking, and delivers a malicious installer that executes when the client's update process runs. No public exploit is identified at time of analysis; the VulnCheck advisory and GitHub issue document the flaw and its exact source locations.