Patriksimek vulnerabilities
77 CVEs and advisories name Patriksimek as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-92939vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine
- CVE-2026-92938vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite
- CVE-2026-92937vm2 3.11.6 Remote Code Execution via Promise call/apply
- CVE-2026-92936vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack
- CVE-2026-92935vm2 NodeVM Remote Code Execution via Array-Shaped Require
- CVE-2026-92934vm2 before 3.11.8 Sandbox Escape RCE via AggregateError
- CVE-2026-92933vm2 before 3.11.8 Information Disclosure via util.getCallSites
- CVE-2026-47683vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike
- CVE-2026-47686vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE
- CVE-2026-47698vm2: Sandbox Breakout Using Dangerous Host Proto Mutators
- CVE-2026-47141vm2: NodeVM observability builtins leak host process and HTTP request data
- CVE-2026-47210vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass
- CVE-2026-47208vm2: Sandbox Breakout Using Promise Species
- CVE-2026-47140vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution
- CVE-2026-47139vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server
- CVE-2026-47137vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE
- CVE-2026-47135vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks
- CVE-2026-47131vm2: Sandbox Escape
- CVE-2026-47209vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain
- CVE-2026-44005vm2: Sandbox escape
- CVE-2026-45411vm2: Sandbox Breakout Using Async Generator
- CVE-2026-44009vm2: Sandbox Breakout Through Null Proto Exception
- CVE-2026-44008vm2 has sandbox breakout via `neutralizeArraySpeciesBatch`
- CVE-2026-44007vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command execution
- CVE-2026-44006vm2: Sandbox Escape
- CVE-2026-44004vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)
- CVE-2026-44003vm2: Transformer Fast-Path Bypass Exposes Internal State Variable
- CVE-2026-44002vm2: Host File Path Disclosure via Stack Trace Information Leak
- CVE-2026-44001vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)
- CVE-2026-44000vm2: sandbox boundary bypass via host Promise resolution preserving host object identity