CVEs we hold for Patriksimek
Records whose assigning authority named Patriksimek as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-93606vm2 before 3.12.1 Sandbox Escape via Promise Symbol.speciespatriksimek vm2 CVE-2026-93605vm2 NodeVM before 3.12.1 Remote Code Execution via child_processpatriksimek vm2 CVE-2026-93604vm2 3.11.8 Sandbox Escape via crypto.setFipspatriksimek vm2 CVE-2026-93603vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Functionpatriksimek vm2 CVE-2026-92963vm2 before 3.11.2 Information Disclosure via Internal Statepatriksimek vm2 CVE-2026-92962vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.jspatriksimek vm2 CVE-2026-92961vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypasspatriksimek vm2 CVE-2026-92960vm2 before 3.11.6 Process-wide State Exposure via os and dnspatriksimek vm2 CVE-2026-92959vm2 before 3.11.8 allowAsync Bypass via Promise Thenablepatriksimek vm2 CVE-2026-92958vm2 before 3.11.7 Denylist Bypass via fs/promisespatriksimek vm2 CVE-2026-92957vm2 before 3.11.7 Authentication Bypass via node: Prefixpatriksimek vm2 CVE-2026-92956vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreamingpatriksimek vm2 CVE-2026-92955vm2 before 3.11.8 Sandbox Escape via NodeVMpatriksimek vm2 CVE-2026-92954vm2 3.10.0 through 3.11.5 Denial of Service via Host Promisepatriksimek vm2 CVE-2026-92953vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArraypatriksimek vm2 CVE-2026-92952vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypasspatriksimek vm2 CVE-2026-92951vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolverpatriksimek vm2 CVE-2026-92950vm2 before 3.11.7 Sandbox Escape via CLI requirepatriksimek vm2 CVE-2026-92949vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptorpatriksimek vm2 CVE-2026-92948vm2 3.9.6 through 3.11.5 Sandbox Escape via node:testpatriksimek vm2 CVE-2026-92947vm2 before 3.11.7 Memory Disclosure via Buffer Poolpatriksimek vm2 CVE-2026-92946vm2 before 3.11.7 Remote Code Execution via require.externalpatriksimek vm2 CVE-2026-92945vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matchingpatriksimek vm2 CVE-2026-92944vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protectorpatriksimek vm2 CVE-2026-92942vm2 before 3.11.7 Timeout Bypass via FinalizationRegistrypatriksimek vm2 CVE-2026-92941vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulationpatriksimek vm2 CVE-2026-92940vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgentpatriksimek vm2 CVE-2026-92939vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEnginepatriksimek vm2 CVE-2026-92938vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlitepatriksimek vm2 CVE-2026-92937vm2 3.11.6 Remote Code Execution via Promise call/applypatriksimek vm2 CVE-2026-92936vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stackpatriksimek vm2 CVE-2026-92935vm2 NodeVM Remote Code Execution via Array-Shaped Requirepatriksimek vm2 CVE-2026-92934vm2 before 3.11.8 Sandbox Escape RCE via AggregateErrorpatriksimek vm2 CVE-2026-92933vm2 before 3.11.8 Information Disclosure via util.getCallSitespatriksimek vm2 CVE-2026-47698vm2: Sandbox Breakout Using Dangerous Host Proto Mutatorspatriksimek vm2 CVE-2026-47686vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCEpatriksimek vm2 CVE-2026-47683vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLikepatriksimek vm2 CVE-2026-47210vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypasspatriksimek vm2 CVE-2026-47209vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chainpatriksimek vm2 CVE-2026-47208vm2: Sandbox Breakout Using Promise Speciespatriksimek vm2 CVE-2026-47141vm2: NodeVM observability builtins leak host process and HTTP request datapatriksimek vm2 CVE-2026-47140vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code executionpatriksimek vm2 CVE-2026-47139vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_serverpatriksimek vm2 CVE-2026-47137vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCEpatriksimek vm2 CVE-2026-47135vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checkspatriksimek vm2 CVE-2026-45411vm2: Sandbox Breakout Using Async Generatorpatriksimek vm2 CVE-2026-44009vm2: Sandbox Breakout Through Null Proto Exceptionpatriksimek vm2 CVE-2026-44008vm2: Snabox breakout via `neutralizeArraySpeciesBatch`patriksimek vm2 CVE-2026-44007vm2: nesting: true bypasses require: false, allowing sandbox escape to arbitrary OS command executionpatriksimek vm2 CVE-2026-44004vm2: Host Process OOM DoS via Buffer.alloc (Timeout Bypass)patriksimek vm2 CVE-2026-44003vm2: Transformer Fast-Path Bypass Exposes Internal State Variablepatriksimek vm2 CVE-2026-44002vm2: Host File Path Disclosure via Stack Trace Information Leakpatriksimek vm2 CVE-2026-44001vm2: Sandbox Escape via Promise Constructor Unhandled Rejection (Process Crash DoS)patriksimek vm2 CVE-2026-44000vm2: sandbox boundary bypass via host Promise resolution preserving host object identitypatriksimek vm2 CVE-2026-43999vm2: NodeVM builtin allowlist bypass via `module` builtin's `Module._load` allows sandbox escapepatriksimek vm2 CVE-2026-43998vm2: NodeVM require.root bypass via symlink traversal allows sandbox escapepatriksimek vm2 CVE-2026-24120vm2: Sandbox Breakout Through Promise Speciespatriksimek vm2 CVE-2026-24118VM2 Sandbox Breakout Through __lookupGetter__patriksimek vm2 CVE-2022-36067vm2 vulnerable to Sandbox Escape before v3.9.11patriksimek vm2 74 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.