Patriksimek Vm2 vulnerabilities

• patriksimek vm2 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool CVE-2026-100723 Fix available 6.9 MediumSeptember 27, 2026
• patriksimek vm2 vm2 before 3.12.2 Host Process Termination via Construct Trap CVE-2026-100722 Fix available 8.9 HighSeptember 27, 2026
• patriksimek vm2 vm2 before 3.12.2 Authorization Bypass via Custom Resolver CVE-2026-100721 Public exploitFix available 9.5 CriticalSeptember 27, 2026
• patriksimek vm2 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species CVE-2026-93606 10.0 CriticalSeptember 18, 2026
• patriksimek vm2 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process CVE-2026-93605 Fix available 10.0 CriticalSeptember 18, 2026
• patriksimek vm2 vm2 3.11.8 Sandbox Escape via crypto.setFips CVE-2026-93604 6.9 MediumSeptember 18, 2026
• patriksimek vm2 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function CVE-2026-93603 10.0 CriticalSeptember 18, 2026
• patriksimek vm2 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable CVE-2026-92959 Fix available 7.1 HighSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 Denylist Bypass via fs/promises CVE-2026-92958 Fix available 8.4 HighSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix CVE-2026-92957 Fix available 9.4 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming CVE-2026-92956 Public exploitFix available 10.0 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.8 Sandbox Escape via NodeVM CVE-2026-92955 Fix available 10.0 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise CVE-2026-92954 Fix available 9.2 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray CVE-2026-92953 Fix available 9.3 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass CVE-2026-92952 Fix available 8.9 HighSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver CVE-2026-92951 Fix available 9.4 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 Sandbox Escape via CLI require CVE-2026-92950 Fix available 9.3 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor CVE-2026-92949 Fix available 6.3 MediumSeptember 17, 2026
• patriksimek vm2 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test CVE-2026-92948 Fix available 9.4 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 Memory Disclosure via Buffer Pool CVE-2026-92947 Fix available 10.0 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 Remote Code Execution via require.external CVE-2026-92946 Fix available 10.0 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching CVE-2026-92945 Fix available 2.3 LowSeptember 17, 2026
• patriksimek vm2 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector CVE-2026-92944 Fix available 9.3 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry CVE-2026-92942 Fix available 8.7 HighSeptember 17, 2026
• patriksimek vm2 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation CVE-2026-92941 Fix available 10.0 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent CVE-2026-92940 Fix available 10.0 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine CVE-2026-92939 Fix available 9.4 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite CVE-2026-92938 Fix available 9.4 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.11.6 Remote Code Execution via Promise call/apply CVE-2026-92937 Fix available 10.0 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack CVE-2026-92936 Fix available 6.9 MediumSeptember 17, 2026
• patriksimek vm2 vm2 NodeVM Remote Code Execution via Array-Shaped Require CVE-2026-92935 Public exploitFix available 9.5 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError CVE-2026-92934 Fix available 9.5 CriticalSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.8 Information Disclosure via util.getCallSites CVE-2026-92933 Fix available 6.9 MediumSeptember 17, 2026
• patriksimek vm2 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass CVE-2026-92961 Fix available 8.7 HighAugust 17, 2026
• patriksimek vm2 vm2 before 3.11.6 Process-wide State Exposure via os and dns CVE-2026-92960 Fix available 10.0 CriticalAugust 17, 2026
• patriksimek vm2 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators CVE-2026-47698 Fix available 9.8 CriticalAugust 17, 2026
• patriksimek vm2 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE CVE-2026-47686 Fix available 9.9 CriticalAugust 17, 2026
• patriksimek vm2 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike CVE-2026-47683 Fix available 8.7 HighAugust 17, 2026
• patriksimek vm2 vm2: NodeVM observability builtins leak host process and HTTP request data CVE-2026-47141 Fix available 6.9 MediumMay 29, 2026
• patriksimek vm2 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server CVE-2026-47139 Fix available 8.6 HighMay 29, 2026
• patriksimek vm2 vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution CVE-2026-47140 Fix available 10.0 CriticalMay 29, 2026
• patriksimek vm2 vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass CVE-2026-47210 Fix available 9.8 CriticalMay 29, 2026
• patriksimek vm2 vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE CVE-2026-47137 Fix available 10.0 CriticalMay 29, 2026
• patriksimek vm2 vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain CVE-2026-47209 Fix available 8.6 HighMay 29, 2026
• patriksimek vm2 vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks CVE-2026-47135 Fix available 8.7 HighMay 29, 2026
• patriksimek vm2 vm2: Sandbox Breakout Using Promise Species CVE-2026-47208 Fix available 10.0 CriticalMay 29, 2026
• patriksimek vm2 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js CVE-2026-92962 Fix available 2.1 LowMay 29, 2026
• patriksimek vm2 vm2: Sandbox Escape CVE-2026-47131 Fix available 10.0 CriticalMay 29, 2026
• patriksimek vm2, red hat ansible automation platform 2.1, developer hub +2 more vm2: Sandbox Breakout Using Async Generator CVE-2026-45411 Fix available 9.8 CriticalMay 13, 2026
• patriksimek vm2 vm2 before 3.11.2 Information Disclosure via Internal State CVE-2026-92963 Fix available 6.9 MediumMay 8, 2026
• Show olderLoading…