KaringX ClashMi disables TLS certificate validation by default in its HttpUtils helper. This flaw allows an attacker controlling the user’s proxy node to present any SSL/TLS certificate, intercepting HTTPS traffic and delivering a forged update manifest that omits the expected SHA‑256 checksum. When the user applies this update, the malicious installer runs, giving the attacker full code execution on the affected device. The weakness is a TLS validation bypass combined with an insecure update mechanism, classified as CWE‑295.

ClashMi version 1.0.32.1801 and earlier from KaringX are vulnerable. No other versions or products were indicated as affected in the available data.

The CVSS score of 7.7 reflects a high severity risk. The EPSS value is not available, and the vulnerability is not listed as a known exploited vulnerability in the CISA KEV catalog. Attackers would need control over the proxy used by the victim or compromise the network path to host a malicious update server, making the attack likely limited to environments where such proxy control is possible.