patriksimek vm2

• CVE-2026-100723 High 7.5 vm2 before 3.12.2 Memory Disclosure via zlib Buffer Pool 0.4%
• CVE-2026-100722 Medium 6.8 vm2 before 3.12.2 Host Process Termination via Construct Trap 0.3%
• CVE-2026-100721 Critical 9.0 vm2 before 3.12.2 Authorization Bypass via Custom Resolver 0.6%
• CVE-2026-93606 Critical 10.0 vm2 before 3.12.1 Sandbox Escape via Promise Symbol.species 0.7%
• CVE-2026-93605 Critical 10.0 vm2 NodeVM before 3.12.1 Remote Code Execution via child_process 0.5%
• CVE-2026-93604 High 7.2 vm2 3.11.8 Sandbox Escape via crypto.setFips 0.3%
• CVE-2026-93603 Critical 10.0 vm2 before 3.12.1 Sandbox Escape RCE via Non-Strict Host Function 0.7%
• CVE-2026-92963 Medium 5.3 vm2 before 3.11.2 Information Disclosure via Internal State 0.3%
• CVE-2026-92962 Low 2.1 vm2 before 3.11.4 Defense Invariant Violation via setup-sandbox.js 0.2%
• CVE-2026-92961 High 7.5 vm2 before 3.11.6 Memory Exhaustion DoS via bufferAllocLimit Bypass 0.5%
• CVE-2026-92960 Critical 10.0 vm2 before 3.11.6 Process-wide State Exposure via os and dns 0.5%
• CVE-2026-92959 High 7.1 vm2 before 3.11.8 allowAsync Bypass via Promise Thenable 0.4%
• CVE-2026-92958 High 8.5 vm2 before 3.11.7 Denylist Bypass via fs/promises 0.4%
• CVE-2026-92957 Critical 9.9 vm2 before 3.11.7 NodeVM Builtin Deny-List Bypass via node: Prefix 0.5%
• CVE-2026-92956 Critical 10.0 vm2 3.10.1 through 3.11.6 Sandbox Escape via WebAssembly.compileStreaming 0.5%
• CVE-2026-92955 Critical 10.0 vm2 before 3.11.8 Sandbox Escape via NodeVM 0.7%
• CVE-2026-92954 High 8.6 vm2 3.10.0 through 3.11.7 Denial of Service via Host Promise 0.5%
• CVE-2026-92953 Critical 10.0 vm2 3.11.0 through 3.11.7 Prototype Pollution via TypedArray 0.5%
• CVE-2026-92952 Medium 6.8 vm2 3.11.4 through 3.11.6 Sandbox Symbol Filtering Bypass 0.5%
• CVE-2026-92951 Critical 9.9 vm2 before 3.11.7 Module Allowlist Bypass via Custom Resolver 0.5%
• CVE-2026-92950 High 8.6 vm2 before 3.11.7 Sandbox Escape via CLI require 0.2%
• CVE-2026-92949 Medium 4.0 vm2 3.9.6 before 3.11.7 Sandbox Bypass via Accessor Descriptor 0.3%
• CVE-2026-92948 Critical 9.9 vm2 3.9.6 through 3.11.5 Sandbox Escape via node:test 0.7%
• CVE-2026-92947 Critical 10.0 vm2 before 3.11.7 Memory Disclosure via Buffer Pool 0.5%
• CVE-2026-92946 Critical 10.0 vm2 before 3.11.7 Remote Code Execution via require.external 0.8%
• CVE-2026-92945 Medium 4.2 vm2 before 3.11.7 Module Allowlist Bypass via Prefix Matching 0.3%
• CVE-2026-92944 Critical 9.8 vm2 3.10.2 through 3.11.6 Sandbox Escape via Promise Protector 0.8%
• CVE-2026-92942 High 7.5 vm2 before 3.11.7 Timeout Bypass via FinalizationRegistry 0.5%
• CVE-2026-92941 Critical 10.0 vm2 3.11.3 before 3.11.7 TLS Trust Store Manipulation 0.3%
• CVE-2026-92940 Critical 10.0 vm2 3.11.3 through 3.11.6 HTTPS Credential Exposure via globalAgent 0.4%
• CVE-2026-92939 Critical 9.9 vm2 3.11.3 through 3.11.6 Native Code Execution via crypto.setEngine 0.6%
• CVE-2026-92938 Critical 9.9 vm2 3.11.3 through 3.11.6 Remote Code Execution via node:sqlite 0.6%
• CVE-2026-92937 Critical 10.0 vm2 3.11.6 Remote Code Execution via Promise call/apply 1.0%
• CVE-2026-92936 Medium 5.8 vm2 3.11.0 before 3.11.7 Information Disclosure via Error Stack 0.5%
• CVE-2026-92935 Critical 9.0 vm2 NodeVM Remote Code Execution via Array-Shaped Require 0.6%
• CVE-2026-92934 Critical 9.0 vm2 before 3.11.8 Sandbox Escape RCE via AggregateError 0.8%
• CVE-2026-92933 Medium 5.8 vm2 before 3.11.8 Information Disclosure via util.getCallSites 0.4%
• CVE-2026-47683 High 8.7 vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike 0.5%
• CVE-2026-47686 Critical 9.9 vm2: Missing Error.cause Sanitization Enables VM2 Sandbox Escape to RCE 0.6%
• CVE-2026-47698 Critical 9.8 vm2: Sandbox Breakout Using Dangerous Host Proto Mutators 1.0%
• CVE-2026-47141 Medium 6.9 vm2: NodeVM observability builtins leak host process and HTTP request data 0.4%
• CVE-2026-47210 Critical 9.8 vm2 sandbox escape via JSPI-backed Promise `.finally()` species bypass 1.7%
• CVE-2026-47208 Critical 10.0 vm2: Sandbox Breakout Using Promise Species 1.0%
• CVE-2026-47140 Critical 10.0 vm2: NodeVM builtin denylist bypass via process and inspector/promises allows host code execution 1.0%
• CVE-2026-47139 High 8.6 vm2: NodeVM network builtin exclusions bypass via internal _http_client and _http_server 0.4%
• CVE-2026-47137 Critical 10.0 vm2: GHSA-8hg8-63c5-gwmx patch bypass: nesting:true without explicit require still allows full RCE 0.4%
• CVE-2026-47135 High 8.7 vm2: Sandbox escape via unblocked cross-realm Symbol.for keys + missing bridge write-trap symbol checks 0.3%
• CVE-2026-47131 Critical 10.0 vm2: Sandbox Escape 0.8%
• CVE-2026-47209 High 8.6 vm2: Bridge Proxy set trap ignores receiver parameter, enabling host object property injection via prototype chain 0.3%
• CVE-2026-44005 Critical 10.0 vm2: Sandbox escape 0.8%