patriksimek vulnerabilities

By year

Bars are flaws published each year; the red part is the share attackers have used.

Latest high and critical flaws

• CVE-2026-100722 vm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap.High 8.9 · Sep 26, 2026
• CVE-2026-100721 vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver.Critical 9.5 · Sep 26, 2026
• CVE-2026-93606 vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`.Critical 10 · Sep 18, 2026
• CVE-2026-93605 vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking other host-sCritical 10 · Sep 18, 2026
• CVE-2026-93603 vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code caCritical 10 · Sep 18, 2026
• CVE-2026-92961 vm2 before 3.11.6 fails to enforce bufferAllocLimit on ArrayBuffer, SharedArrayBuffer, and TypedArray constructors, allowing attackers to allocate arbitrary hosHigh 8.7 · Sep 17, 2026
• CVE-2026-92960 vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity anCritical 10 · Sep 17, 2026
• CVE-2026-92959 vm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM.High 7.1 · Sep 17, 2026
• CVE-2026-92958 vm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM.High 8.4 · Sep 17, 2026
• CVE-2026-92957 vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require polCritical 9.4 · Sep 17, 2026
• CVE-2026-92956 vm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26.Critical 10 · Sep 17, 2026
• CVE-2026-92955 vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout andCritical 10 · Sep 17, 2026
• CVE-2026-92954 vm2 is a sandbox library for running untrusted JavaScript in Node.js.Critical 9.2 · Sep 17, 2026
• CVE-2026-92953 vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation.Critical 9.3 · Sep 17, 2026
• CVE-2026-92952 vm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary.High 8.9 · Sep 17, 2026
• CVE-2026-92951 vm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching instead of fuCritical 9.4 · Sep 17, 2026
• CVE-2026-92950 vm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js process.Critical 9.3 · Sep 17, 2026
• CVE-2026-92948 vm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the embedder exCritical 9.4 · Sep 17, 2026
• CVE-2026-92947 vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocaCritical 10 · Sep 17, 2026
• CVE-2026-92946 vm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes node_modules.Critical 10 · Sep 17, 2026
• CVE-2026-92944 vm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper protections dueCritical 9.3 · Sep 17, 2026
• CVE-2026-92942 vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call.High 8.7 · Sep 17, 2026
• CVE-2026-92941 vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace Critical 10 · Sep 17, 2026
• CVE-2026-92940 vm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow require('hCritical 10 · Sep 17, 2026
• CVE-2026-92939 vm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed.Critical 9.4 · Sep 17, 2026