[ Vendor · 30 CVEs ]
patriksimek
CVEs affecting patriksimek published in the last 30 days, plus any patriksimek CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-100723 | 27 Sep 2026 | CVSS 7.5 | vm2: NodeVM zlib Buffers expose pooled host memory across the VM boundaryvm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 and buffer.byteLength === length) to Buffers returned… | Fix |
| CVE-2026-100722 | 27 Sep 2026 | CVSS 6.8 | vm2: Host Promise rejection from an exposed constructor can terminate the vm2 host processvm2 before 3.12.2 does not apply host-side Promise rejection handling in the sandbox-to-host construct trap. In BaseHandler, the apply trap calls… | Fix |
| CVE-2026-100721 | 27 Sep 2026 | CVSS 9.0 | vm2: NodeVM custom resolution bypasses external path boundariesvm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When an embedder configures `require.external` with a… | Fix |
| CVE-2026-93605 | 18 Sep 2026 | CVSS 10.0 | vm2 contains a sandbox escape vulnerabilityvm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUS_BUILTINS denylist omits child_process despite blocking… | Fix |
| CVE-2026-92959 | 17 Sep 2026 | CVSS 7.1 | vm2: `allowAsync: false` can be bypassed through Promise thenable assimilation in VM and NodeVMvm2 before 3.11.8 does not fully enforce the allowAsync: false option in VM and NodeVM. While localPromise.prototype.then is replaced with a handler… | Fix |
| CVE-2026-92958 | 17 Sep 2026 | CVSS 8.5 | vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writesvm2 through 3.11.6 contains a builtin-module denylist bypass in NodeVM. When the embedder uses the builtin wildcard together with negative entries… | Fix |
| CVE-2026-92956 | 17 Sep 2026 | CVSS 10.0 | vm2 sandbox escape via WebAssembly.compileStreaming Promise species bypassvm2 versions 3.10.1 through 3.11.6 contain a sandbox escape reachable from a default `new VM()` sandbox when running on Node.js 26… | Fix |
| CVE-2026-92957 | 17 Sep 2026 | CVSS 9.9 | vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_processvm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard… | Fix |
| CVE-2026-92955 | 17 Sep 2026 | CVSS 10.0 | vm2: Sandbox Escape (NodeVM)vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through… | Fix |
| CVE-2026-92953 | 17 Sep 2026 | CVSS 10.0 | vm2: Default VM can mutate host TypedArray and ArrayBuffer intrinsics after the host-prototype pollution fixvm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation. Attackers can use… | Fix |
| CVE-2026-92954 | 17 Sep 2026 | CVSS 8.6 | vm2: Host-returned Promise rejection can bypass vm2's unhandled-rejection hardening and terminate the host processvm2 is a sandbox library for running untrusted JavaScript in Node.js. In versions >= 3.10.0 and <= 3.11.7, Promises returned from the host realm into… | Fix |
| CVE-2026-92952 | 17 Sep 2026 | CVSS 6.8 | vm2: Incomplete nodejs.* symbol filtering lets sandbox override host WebStream state checksvm2 versions 3.11.4 through 3.11.6 incompletely filter Node.js registered internal symbols across the sandbox boundary. The extraction filters in… | Fix |
| CVE-2026-92950 | 17 Sep 2026 | CVSS 8.6 | vm2 CLI provides no sandbox isolation - host-realm require() is reachable from sandboxed scriptsvm2 before 3.11.7 contains a sandbox escape vulnerability in the CLI tool that allows attackers to execute arbitrary code in the host Node.js… | Fix |
| CVE-2026-92951 | 17 Sep 2026 | CVSS 9.9 | vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Packagevm2 before 3.11.7 contains an incorrect authorization vulnerability in the external package allowlist check that uses non-exact substring matching… | Fix |
| CVE-2026-92949 | 17 Sep 2026 | CVSS 4.0 | vm2: vm.freeze()/vm.readonly() bypass via accessor descriptorvm2 versions from 3.9.6 before 3.11.7 fail to properly restrict access to accessor properties on frozen objects, allowing sandboxed scripts to bypass… | Fix |
| CVE-2026-92947 | 17 Sep 2026 | CVSS 10.0 | vm2: Sandboxed code can read and write host-realm memory via Node's shared Buffer poolvm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and… | Fix |
| CVE-2026-92948 | 17 Sep 2026 | CVSS 9.9 | vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escapevm2 versions >= 3.9.6 and <= 3.11.6 are affected by a NodeVM builtin allowlist bypass that permits a sandbox escape on Node.js 24 and newer when the… | Fix |
| CVE-2026-92946 | 17 Sep 2026 | CVSS 10.0 | vm2: NodeVM `require.external` without an explicit `require.root` grants unrestricted host filesystem access and full RCEvm2 before 3.11.7 contains a remote code execution vulnerability when require.external is enabled without an explicit require.root that excludes… | Fix |
| CVE-2026-92944 | 17 Sep 2026 | CVSS 9.8 | vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protectorvm2 versions 3.10.2 through 3.11.6 contain a sandbox escape vulnerability on Node.js 26 where Promise.prototype.finally() bypasses vm2's wrapper… | Fix |
| CVE-2026-92945 | 17 Sep 2026 | CVSS 4.2 | vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlistedvm2 before 3.11.7 contains a module allowlist bypass vulnerability in isPathAllowedForModule that uses raw string prefix matching instead of… | Fix |
| CVE-2026-92942 | 17 Sep 2026 | CVSS 7.5 | vm2: timeout Option Bypass via FinalizationRegistry Cleanup Callback (Unbounded Host Event-Loop Block)vm2 before 3.11.7 (affected versions <= 3.11.6) does not enforce the VM({ timeout }) option on code executed outside the synchronous VM#run() call… | Fix |
| CVE-2026-92940 | 17 Sep 2026 | CVSS 10.0 | vm2 exposes host HTTPS credentials and TLS traffic through globalAgentvm2 versions 3.11.3 through 3.11.6 expose the host process's real https.globalAgent to sandboxed code when a NodeVM is explicitly configured to allow… | Fix |
| CVE-2026-92941 | 17 Sep 2026 | CVSS 10.0 | vm2 NodeVM can replace the host process TLS trust storevm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates()… | Fix |
| CVE-2026-92939 | 17 Sep 2026 | CVSS 9.9 | vm2 crypto builtin loads attacker native code through setEnginevm2 3.11.3 through 3.11.6 exposes the host Node.js crypto module to a NodeVM sandbox when the crypto builtin is allowed. The module is presented via… | Fix |
| CVE-2026-92937 | 17 Sep 2026 | CVSS 10.0 | vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirectionvm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process. The fix for GHSA-m283-3h24-438v is… | Fix |
| CVE-2026-92938 | 17 Sep 2026 | CVSS 9.9 | vm2 allows a sandboxed plugin to execute native code through `node:sqlite`vm2 versions 3.11.3 through 3.11.6 expose Node.js's host node:sqlite module to code running in NodeVM when that builtin is permitted, either… | Fix |
| CVE-2026-92936 | 17 Sep 2026 | CVSS 5.8 | vm2 leaks absolute host filesystem paths to sandbox code via error stack formattingvm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can… | Fix |
| CVE-2026-92934 | 17 Sep 2026 | CVSS 9.0 | vm2 sandbox escape to host RCE via revisited host-wrapped AggregateError bypassing Error sanitization cycle short-circuitvm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError… | Fix |
| CVE-2026-92935 | 17 Sep 2026 | CVSS 9.0 | vm2: NodeVM nesting guard accepts array-shaped require and permits host RCEvm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with… | Fix |
| CVE-2026-92933 | 17 Sep 2026 | CVSS 5.8 | vm2: util.getCallSites() bypasses GHSA-v27g-jcqj-v8rw host-frame redaction, leaks host call stackvm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered… | Fix |