patriksimek

Records81All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical54CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

patriksimek records in CISA KEV

No patriksimek vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Vm2 32 records CRITICAL

Records

81 records

TI-2023-14382 CVE-2023-30547 · GHSA-ch3r-j5x3-6q2m

Sandbox Escape in vm2

CRITICAL 87

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.72973 Published 2023-04-17 Partial fix · 3.9.17 CWE-74

TI-2023-13478 CVE-2023-29017 · GHSA-7jxr-cg7f-gpgv

vm2 Sandbox Escape vulnerability

HIGH 84

vm2 is a sandbox that can run untrusted code with whitelisted Node's built-in modules.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.63186 Published 2023-04-06 Partial fix · 3.9.15 CWE-913

TI-2026-63070 CVE-2026-93606 · GHSA-q84h-7qfg-c6j8

vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species

HIGH 82

vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00712 Published 2026-09-18 Fixed in 3.12.1 CWE-693

TI-2026-63067 CVE-2026-93603 · GHSA-2mqq-5j76-f3c6

vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function

HIGH 82

vm2 through 3.12.0 (fixed in 3.12.1) does not correctly handle a nullish `this` receiver in the apply trap of its bridge (lib/bridge.js): when sandboxed code calls a host-provided non-strict (sloppy-mode) function withou…

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00726 Published 2026-09-18 Fixed in 3.12.1 CWE-94

TI-2026-62623 CVE-2026-92960 · GHSA-qj2x-7x9q-qgm7

vm2 before 3.11.6 Process-wide State Exposure via os and dns

HIGH 82

vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00474 Published 2026-09-17 Fixed in 3.11.6 CWE-200

TI-2026-62618 CVE-2026-92955 · GHSA-88hf-g992-jg85 · GHSA-gg6f-mhqm-f7gp

vm2 before 3.11.8 Sandbox Escape via NodeVM

HIGH 82

vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00712 Published 2026-09-17 Fixed in 3.11.8 CWE-913

TI-2026-62610 CVE-2026-92947 · GHSA-fcqc-726x-5wfc · GHSA-x5qg-8pq6-39h6

vm2 before 3.11.7 Memory Disclosure via Buffer Pool

HIGH 82

vm2 before 3.11.7 exposes Node's shared Buffer pool to sandboxed code, allowing disclosure of host memory used by Buffer.from, Buffer.concat, and related allocations.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00482 Published 2026-09-17 Fixed in 3.11.7 CWE-200

TI-2026-62604 CVE-2026-92941 · GHSA-98xx-8mx4-x7cm

vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation

HIGH 82

vm2 versions from 3.11.3 before 3.11.7 expose the host tls module to NodeVM sandbox code, allowing attackers to call tls.setDefaultCACertificates() and replace process-wide certificate authorities.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.00289 Published 2026-09-17 Fixed in 3.11.7 CWE-732

TI-2026-62600 CVE-2026-92937 · GHSA-647f-g98j-qq25

vm2 3.11.6 Remote Code Execution via Promise call/apply

HIGH 82

vm2 3.11.6 is vulnerable to a sandbox escape leading to remote code execution in the host Node.js process.

CVSS 4.0CRITICAL 10.0 Network No auth No interaction EPSS 0.01033 Published 2026-09-17 Fixed in 3.11.7 CWE-94

TI-2026-35202 CVE-2026-47698 · GHSA-cfcw-xp6x-25gj