# Patriksimek Vm2 vulnerabilities Source: https://junglewise.ai/threats/technologies/patriksimek-vm2 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/patriksimek-vm2.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 29 vulnerabilities in Patriksimek Vm2: 0 in the last 7 days and 26 in the last 90 days, 17 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM path bypass in custom resolution, was published on 27 September 2026. Nothing in the last four weeks, down from 26 vulnerabilities in the four before. 0 critical against 14. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 26 - All time: 29 (17 critical, 0 exploited in the wild) ## About Patriksimek Vm2 JavaScript library that provides a safe sandbox environment for executing untrusted code. ## Latest Patriksimek Vm2 vulnerabilities - [vm2 NodeVM path bypass in custom resolution](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272) (critical, CVSS 9, published 27 Sep 2026) - [CVE-2026-93605: vm2 NodeVM sandbox escape via child_process denylist omission](https://junglewise.ai/threats/cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission) (critical, CVSS 10, published 18 Sep 2026) - [vm2 Promise rejection denial of service](https://junglewise.ai/threats/duplicate-advisory-vm2-host-returned-promise-rejection-can-bypass-vm2-s-e131e247) (high, CVSS 8.6, published 17 Sep 2026) - [vm2 CLI sandbox escape via require(__filename)](https://junglewise.ai/threats/duplicate-advisory-vm2-cli-provides-no-sandbox-isolation-host-realm-a5de364c) (high, CVSS 8.6, published 17 Sep 2026) - [vm2 NodeVM sandbox escape via prototype pollution](https://junglewise.ai/threats/duplicate-advisory-sandbox-escape-nodevm-d6fa5619) (critical, CVSS 10, published 17 Sep 2026) - [vm2 NodeVM builtin denylist bypass via fs/promises](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-builtin-denylist-bypass-via-fs-promises-d3a51a7c) (high, CVSS 8.5, published 17 Sep 2026) - [vm2 NodeVM TLS trust store manipulation](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778) (critical, CVSS 10, published 17 Sep 2026) - [vm2 NodeVM builtin allowlist bypass sandbox escape](https://junglewise.ai/threats/duplicate-advisory-nodevm-builtin-allowlist-bypass-via-node-test-run-7e8a6e4e) (critical, CVSS 9.9, published 17 Sep 2026) - [vm2 module allowlist bypass via prefix matching](https://junglewise.ai/threats/duplicate-advisory-external-module-allowlist-uses-a-raw-prefix-test-so-95e7475b) (medium, CVSS 4.2, published 17 Sep 2026) - [vm2 information disclosure via error stack formatting](https://junglewise.ai/threats/duplicate-advisory-vm2-leaks-absolute-host-filesystem-paths-to-sandbox-a59ab86f) (medium, CVSS 5.8, published 17 Sep 2026) - [vm2 information disclosure via util.getCallSites()](https://junglewise.ai/threats/duplicate-advisory-vm2-util-getcallsites-bypasses-ghsa-v27g-host-frame-d15f7df3) (medium, CVSS 5.8, published 17 Sep 2026) - [vm2 HTTPS credentials exposure through globalAgent proxy bypass](https://junglewise.ai/threats/duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92963: vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`](https://junglewise.ai/threats/cve-2026-92963-vm2-internal-state-disclosure-in-computed-key-access) (medium, CVSS 5.3, published 17 Sep 2026) - [CVE-2026-92959: vm2 allowAsync bypass via Promise thenable assimilation](https://junglewise.ai/threats/cve-2026-92959-vm2-allowasync-bypass-via-promise-thenable-assimilation) (high, CVSS 7.1, published 17 Sep 2026) - [CVE-2026-92954: vm2 host Promise rejection denial of service](https://junglewise.ai/threats/cve-2026-92954-vm2-host-promise-rejection-denial-of-service) (high, CVSS 8.6, published 17 Sep 2026) - [CVE-2026-92953: vm2 prototype pollution in TypedArray and ArrayBuffer](https://junglewise.ai/threats/cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92952: vm2 sandbox symbol filtering bypass in Node.js symbol isolation](https://junglewise.ai/threats/cve-2026-92952-vm2-sandbox-symbol-filtering-bypass-in-node-js-symbol-isolation) (medium, CVSS 6.8, published 17 Sep 2026) - [CVE-2026-92951: vm2 module allowlist bypass via substring matching](https://junglewise.ai/threats/cve-2026-92951-vm2-module-allowlist-bypass-via-substring-matching) (critical, CVSS 9.9, published 17 Sep 2026) - [CVE-2026-92949: vm2 sandbox bypass via accessor descriptor on frozen objects](https://junglewise.ai/threats/cve-2026-92949-vm2-sandbox-bypass-via-accessor-descriptor-on-frozen-objects) (medium, CVSS 4, published 17 Sep 2026) - [CVE-2026-92947: vm2 memory disclosure via shared Buffer pool](https://junglewise.ai/threats/cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92946: vm2 remote code execution in NodeVM require.external](https://junglewise.ai/threats/cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92941: vm2 NodeVM sandbox escape via TLS trust store manipulation](https://junglewise.ai/threats/cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92940: vm2 HTTPS credential exposure via globalAgent](https://junglewise.ai/threats/cve-2026-92940-vm2-https-credential-exposure-via-globalagent) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92939: vm2 crypto builtin sandbox escape via setEngine](https://junglewise.ai/threats/cve-2026-92939-vm2-crypto-builtin-sandbox-escape-via-setengine) (critical, CVSS 9.9, published 17 Sep 2026) - [CVE-2026-92937: vm2 sandbox escape in Promise rejection handling](https://junglewise.ai/threats/cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling) (critical, CVSS 10, published 17 Sep 2026) ## Most severe Patriksimek Vm2 vulnerabilities - [CVE-2026-92937: vm2 sandbox escape in Promise rejection handling](https://junglewise.ai/threats/cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92946: vm2 remote code execution in NodeVM require.external](https://junglewise.ai/threats/cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-93605: vm2 NodeVM sandbox escape via child_process denylist omission](https://junglewise.ai/threats/cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission) (critical, CVSS 10, published 18 Sep 2026) - [CVE-2026-92953: vm2 prototype pollution in TypedArray and ArrayBuffer](https://junglewise.ai/threats/cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92947: vm2 memory disclosure via shared Buffer pool](https://junglewise.ai/threats/cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92940: vm2 HTTPS credential exposure via globalAgent](https://junglewise.ai/threats/cve-2026-92940-vm2-https-credential-exposure-via-globalagent) (critical, CVSS 10, published 17 Sep 2026) - [CVE-2026-92941: vm2 NodeVM sandbox escape via TLS trust store manipulation](https://junglewise.ai/threats/cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation) (critical, CVSS 10, published 17 Sep 2026) - [vm2 NodeVM sandbox escape via prototype pollution](https://junglewise.ai/threats/duplicate-advisory-sandbox-escape-nodevm-d6fa5619) (critical, CVSS 10, published 17 Sep 2026) - [vm2 NodeVM TLS trust store manipulation](https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778) (critical, CVSS 10, published 17 Sep 2026) - [vm2 HTTPS credentials exposure through globalAgent proxy bypass](https://junglewise.ai/threats/duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c) (critical, CVSS 10, published 17 Sep 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 26 vulnerabilities in the four before. 0 critical against 14. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 25 | 13 | 0 | | 21 Sep 2026 | 1 | 1 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Patriksimek Vm2 vulnerabilities", https://junglewise.ai/threats/technologies/patriksimek-vm2, 9 November 2026.