{"schema_version":1,"title":"Patriksimek Vm2 vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 29 vulnerabilities in Patriksimek Vm2: 0 in the last 7 days and 26 in the last 90 days, 17 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM path bypass in custom resolution, was published on 27 September 2026. Nothing in the last four weeks, down from 26 vulnerabilities in the four before. 0 critical against 14.","url":"https://junglewise.ai/threats/technologies/patriksimek-vm2","json_url":"https://junglewise.ai/threats/technologies/patriksimek-vm2.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/patriksimek-vm2","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":5,"all_time":29,"critical":17,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":26,"last_365_days":29},"latest":[{"cvss":9,"slug":"duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272","title":"vm2 NodeVM path bypass in custom resolution","severity":"critical","exploited":false,"published_at":"2026-09-27T03:31:03+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272"},{"cve":"CVE-2026-93605","cvss":10,"epss":0.0073,"slug":"cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission","title":"vm2 NodeVM sandbox escape via child_process denylist omission","severity":"critical","exploited":false,"published_at":"2026-09-18T14:19:12.34+00:00","url":"https://junglewise.ai/threats/cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission"},{"cvss":8.6,"slug":"duplicate-advisory-vm2-host-returned-promise-rejection-can-bypass-vm2-s-e131e247","title":"vm2 Promise rejection denial of service","severity":"high","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-host-returned-promise-rejection-can-bypass-vm2-s-e131e247"},{"cvss":8.6,"slug":"duplicate-advisory-vm2-cli-provides-no-sandbox-isolation-host-realm-a5de364c","title":"vm2 CLI sandbox escape via require(__filename)","severity":"high","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-cli-provides-no-sandbox-isolation-host-realm-a5de364c"},{"cvss":10,"slug":"duplicate-advisory-sandbox-escape-nodevm-d6fa5619","title":"vm2 NodeVM sandbox escape via prototype pollution","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-sandbox-escape-nodevm-d6fa5619"},{"cvss":8.5,"slug":"duplicate-advisory-vm2-nodevm-builtin-denylist-bypass-via-fs-promises-d3a51a7c","title":"vm2 NodeVM builtin denylist bypass via fs/promises","severity":"high","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-builtin-denylist-bypass-via-fs-promises-d3a51a7c"},{"cvss":10,"slug":"duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778","title":"vm2 NodeVM TLS trust store manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778"},{"cvss":9.9,"slug":"duplicate-advisory-nodevm-builtin-allowlist-bypass-via-node-test-run-7e8a6e4e","title":"vm2 NodeVM builtin allowlist bypass sandbox escape","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-nodevm-builtin-allowlist-bypass-via-node-test-run-7e8a6e4e"},{"cvss":4.2,"slug":"duplicate-advisory-external-module-allowlist-uses-a-raw-prefix-test-so-95e7475b","title":"vm2 module allowlist bypass via prefix matching","severity":"medium","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-external-module-allowlist-uses-a-raw-prefix-test-so-95e7475b"},{"cvss":5.8,"slug":"duplicate-advisory-vm2-leaks-absolute-host-filesystem-paths-to-sandbox-a59ab86f","title":"vm2 information disclosure via error stack formatting","severity":"medium","exploited":false,"published_at":"2026-09-17T15:32:14+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-leaks-absolute-host-filesystem-paths-to-sandbox-a59ab86f"},{"cvss":5.8,"slug":"duplicate-advisory-vm2-util-getcallsites-bypasses-ghsa-v27g-host-frame-d15f7df3","title":"vm2 information disclosure via util.getCallSites()","severity":"medium","exploited":false,"published_at":"2026-09-17T15:32:14+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-util-getcallsites-bypasses-ghsa-v27g-host-frame-d15f7df3"},{"cvss":10,"slug":"duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c","title":"vm2 HTTPS credentials exposure through globalAgent proxy bypass","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:14+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c"},{"cve":"CVE-2026-92963","cvss":5.3,"epss":0.0034,"slug":"cve-2026-92963-vm2-internal-state-disclosure-in-computed-key-access","title":"vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`","severity":"medium","exploited":false,"published_at":"2026-09-17T14:18:02.783+00:00","url":"https://junglewise.ai/threats/cve-2026-92963-vm2-internal-state-disclosure-in-computed-key-access"},{"cve":"CVE-2026-92959","cvss":7.1,"epss":0.0045,"slug":"cve-2026-92959-vm2-allowasync-bypass-via-promise-thenable-assimilation","title":"vm2 allowAsync bypass via Promise thenable assimilation","severity":"high","exploited":false,"published_at":"2026-09-17T14:18:02.13+00:00","url":"https://junglewise.ai/threats/cve-2026-92959-vm2-allowasync-bypass-via-promise-thenable-assimilation"},{"cve":"CVE-2026-92954","cvss":8.6,"epss":0.0049,"slug":"cve-2026-92954-vm2-host-promise-rejection-denial-of-service","title":"vm2 host Promise rejection denial of service","severity":"high","exploited":false,"published_at":"2026-09-17T14:18:01.32+00:00","url":"https://junglewise.ai/threats/cve-2026-92954-vm2-host-promise-rejection-denial-of-service"},{"cve":"CVE-2026-92953","cvss":10,"epss":0.005,"slug":"cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer","title":"vm2 prototype pollution in TypedArray and ArrayBuffer","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.16+00:00","url":"https://junglewise.ai/threats/cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer"},{"cve":"CVE-2026-92952","cvss":6.8,"epss":0.0046,"slug":"cve-2026-92952-vm2-sandbox-symbol-filtering-bypass-in-node-js-symbol-isolation","title":"vm2 sandbox symbol filtering bypass in Node.js symbol isolation","severity":"medium","exploited":false,"published_at":"2026-09-17T14:18:00.987+00:00","url":"https://junglewise.ai/threats/cve-2026-92952-vm2-sandbox-symbol-filtering-bypass-in-node-js-symbol-isolation"},{"cve":"CVE-2026-92951","cvss":9.9,"epss":0.0054,"slug":"cve-2026-92951-vm2-module-allowlist-bypass-via-substring-matching","title":"vm2 module allowlist bypass via substring matching","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:00.827+00:00","url":"https://junglewise.ai/threats/cve-2026-92951-vm2-module-allowlist-bypass-via-substring-matching"},{"cve":"CVE-2026-92949","cvss":4,"epss":0.0032,"slug":"cve-2026-92949-vm2-sandbox-bypass-via-accessor-descriptor-on-frozen-objects","title":"vm2 sandbox bypass via accessor descriptor on frozen objects","severity":"medium","exploited":false,"published_at":"2026-09-17T14:18:00.463+00:00","url":"https://junglewise.ai/threats/cve-2026-92949-vm2-sandbox-bypass-via-accessor-descriptor-on-frozen-objects"},{"cve":"CVE-2026-92947","cvss":10,"epss":0.0048,"slug":"cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool","title":"vm2 memory disclosure via shared Buffer pool","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:00.14+00:00","url":"https://junglewise.ai/threats/cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool"},{"cve":"CVE-2026-92946","cvss":10,"epss":0.0086,"slug":"cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external","title":"vm2 remote code execution in NodeVM require.external","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.963+00:00","url":"https://junglewise.ai/threats/cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external"},{"cve":"CVE-2026-92941","cvss":10,"epss":0.0029,"slug":"cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation","title":"vm2 NodeVM sandbox escape via TLS trust store manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.31+00:00","url":"https://junglewise.ai/threats/cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation"},{"cve":"CVE-2026-92940","cvss":10,"epss":0.0047,"slug":"cve-2026-92940-vm2-https-credential-exposure-via-globalagent","title":"vm2 HTTPS credential exposure via globalAgent","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.143+00:00","url":"https://junglewise.ai/threats/cve-2026-92940-vm2-https-credential-exposure-via-globalagent"},{"cve":"CVE-2026-92939","cvss":9.9,"epss":0.0062,"slug":"cve-2026-92939-vm2-crypto-builtin-sandbox-escape-via-setengine","title":"vm2 crypto builtin sandbox escape via setEngine","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:58.97+00:00","url":"https://junglewise.ai/threats/cve-2026-92939-vm2-crypto-builtin-sandbox-escape-via-setengine"},{"cve":"CVE-2026-92937","cvss":10,"epss":0.0103,"slug":"cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling","title":"vm2 sandbox escape in Promise rejection handling","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:58.517+00:00","url":"https://junglewise.ai/threats/cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":13,"exploited":0,"vulnerabilities":25},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Patriksimek Vm2","slug":"patriksimek-vm2","vendor":{"hub":true,"name":"Patriksimek","slug":"patriksimek","url":"https://junglewise.ai/threats/vendors/patriksimek"},"aliases":[],"category":"library","description":"JavaScript library that provides a safe sandbox environment for executing untrusted code.","url":"https://junglewise.ai/threats/technologies/patriksimek-vm2"},"most_severe":[{"cve":"CVE-2026-92937","cvss":10,"epss":0.0103,"slug":"cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling","title":"vm2 sandbox escape in Promise rejection handling","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:58.517+00:00","url":"https://junglewise.ai/threats/cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling"},{"cve":"CVE-2026-92946","cvss":10,"epss":0.0086,"slug":"cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external","title":"vm2 remote code execution in NodeVM require.external","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.963+00:00","url":"https://junglewise.ai/threats/cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external"},{"cve":"CVE-2026-93605","cvss":10,"epss":0.0073,"slug":"cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission","title":"vm2 NodeVM sandbox escape via child_process denylist omission","severity":"critical","exploited":false,"published_at":"2026-09-18T14:19:12.34+00:00","url":"https://junglewise.ai/threats/cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission"},{"cve":"CVE-2026-92953","cvss":10,"epss":0.005,"slug":"cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer","title":"vm2 prototype pollution in TypedArray and ArrayBuffer","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.16+00:00","url":"https://junglewise.ai/threats/cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer"},{"cve":"CVE-2026-92947","cvss":10,"epss":0.0048,"slug":"cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool","title":"vm2 memory disclosure via shared Buffer pool","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:00.14+00:00","url":"https://junglewise.ai/threats/cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool"},{"cve":"CVE-2026-92940","cvss":10,"epss":0.0047,"slug":"cve-2026-92940-vm2-https-credential-exposure-via-globalagent","title":"vm2 HTTPS credential exposure via globalAgent","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.143+00:00","url":"https://junglewise.ai/threats/cve-2026-92940-vm2-https-credential-exposure-via-globalagent"},{"cve":"CVE-2026-92941","cvss":10,"epss":0.0029,"slug":"cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation","title":"vm2 NodeVM sandbox escape via TLS trust store manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.31+00:00","url":"https://junglewise.ai/threats/cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation"},{"cvss":10,"slug":"duplicate-advisory-sandbox-escape-nodevm-d6fa5619","title":"vm2 NodeVM sandbox escape via prototype pollution","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-sandbox-escape-nodevm-d6fa5619"},{"cvss":10,"slug":"duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778","title":"vm2 NodeVM TLS trust store manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778"},{"cvss":10,"slug":"duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c","title":"vm2 HTTPS credentials exposure through globalAgent proxy bypass","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:14+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}