Clashmi
Monthly
KaringX ClashMi through 1.0.32.1801 ships an HttpUtils helper that disables TLS certificate validation by default, so any HTTPS response the app fetches - including its auto-update manifest - is accepted regardless of the certificate presented. An attacker who controls or intercepts the proxy node the user routes through can return a forged update manifest that omits the sha256 integrity field and point the updater at a malicious installer, yielding code execution with the privileges of the app when the update runs. Exploitation is unauthenticated (PR:N) but conditional: the adversary must sit in the update request's HTTPS path and the auto-update flow must actually execute, and no public exploit code or CISA KEV entry was identified at time of analysis; the VulnCheck-sourced report is prioritized for remediation this week.
KaringX ClashMi through 1.0.32.1801 ships an HttpUtils helper that disables TLS certificate validation by default, so any HTTPS response the app fetches - including its auto-update manifest - is accepted regardless of the certificate presented. An attacker who controls or intercepts the proxy node the user routes through can return a forged update manifest that omits the sha256 integrity field and point the updater at a malicious installer, yielding code execution with the privileges of the app when the update runs. Exploitation is unauthenticated (PR:N) but conditional: the adversary must sit in the update request's HTTPS path and the auto-update flow must actually execute, and no public exploit code or CISA KEV entry was identified at time of analysis; the VulnCheck-sourced report is prioritized for remediation this week.