Threats tagged 'ghsa-wvpm-52pr-rww8'

KaringX ClashMi versions through 1.0.32.1801 disable TLS certificate validation by default in the HttpUtils helper. This flaw allows attackers controlling the user's proxy node to intercept HTTPS traffic by presenting any certificate. Such attackers can serve a malicious update manifest that omits the sha256 checksum, enabling delivery of a malicious installer and resulting in code execution when the update is run.