{"schema_version":1,"title":"Patriksimek vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 63 vulnerabilities in Patriksimek: 0 in the last 7 days and 31 in the last 90 days, 34 of them critical and 0 exploited in the wild. The most recent, vm2 NodeVM path bypass in custom resolution, was published on 27 September 2026. Nothing in the last four weeks, down from 28 vulnerabilities in the four before. 0 critical against 15. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/patriksimek","json_url":"https://junglewise.ai/threats/vendors/patriksimek.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/patriksimek","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":12,"all_time":63,"critical":34,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":31,"last_365_days":59},"latest":[{"cvss":9,"slug":"duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272","title":"vm2 NodeVM path bypass in custom resolution","severity":"critical","exploited":false,"published_at":"2026-09-27T03:31:03+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-custom-resolution-bypasses-external-path-5d3a7272"},{"cve":"CVE-2026-93605","cvss":10,"epss":0.0073,"slug":"cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission","title":"vm2 NodeVM sandbox escape via child_process denylist omission","severity":"critical","exploited":false,"published_at":"2026-09-18T14:19:12.34+00:00","url":"https://junglewise.ai/threats/cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission"},{"cve":"CVE-2026-93603","cvss":10,"epss":0.0073,"slug":"cve-2026-93603-vm2-sandbox-escape-via-nullish-this-receiver","title":"vm2 sandbox escape via nullish this receiver","severity":"critical","exploited":false,"published_at":"2026-09-18T14:19:12.003+00:00","url":"https://junglewise.ai/threats/cve-2026-93603-vm2-sandbox-escape-via-nullish-this-receiver"},{"cvss":8.6,"slug":"duplicate-advisory-vm2-cli-provides-no-sandbox-isolation-host-realm-a5de364c","title":"vm2 CLI sandbox escape via require(__filename)","severity":"high","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-cli-provides-no-sandbox-isolation-host-realm-a5de364c"},{"cvss":10,"slug":"duplicate-advisory-sandbox-escape-nodevm-d6fa5619","title":"vm2 NodeVM sandbox escape via prototype pollution","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-sandbox-escape-nodevm-d6fa5619"},{"cvss":8.6,"slug":"duplicate-advisory-vm2-host-returned-promise-rejection-can-bypass-vm2-s-e131e247","title":"vm2 Promise rejection denial of service","severity":"high","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-host-returned-promise-rejection-can-bypass-vm2-s-e131e247"},{"cvss":8.5,"slug":"duplicate-advisory-vm2-nodevm-builtin-denylist-bypass-via-fs-promises-d3a51a7c","title":"vm2 NodeVM builtin denylist bypass via fs/promises","severity":"high","exploited":false,"published_at":"2026-09-17T15:32:16+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-builtin-denylist-bypass-via-fs-promises-d3a51a7c"},{"cvss":9.9,"slug":"duplicate-advisory-nodevm-builtin-allowlist-bypass-via-node-test-run-7e8a6e4e","title":"vm2 NodeVM builtin allowlist bypass sandbox escape","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-nodevm-builtin-allowlist-bypass-via-node-test-run-7e8a6e4e"},{"cvss":4.2,"slug":"duplicate-advisory-external-module-allowlist-uses-a-raw-prefix-test-so-95e7475b","title":"vm2 module allowlist bypass via prefix matching","severity":"medium","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-external-module-allowlist-uses-a-raw-prefix-test-so-95e7475b"},{"cvss":10,"slug":"duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778","title":"vm2 NodeVM TLS trust store manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:15+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-nodevm-can-replace-the-host-process-tls-trust-fdea8778"},{"cvss":5.8,"slug":"duplicate-advisory-vm2-util-getcallsites-bypasses-ghsa-v27g-host-frame-d15f7df3","title":"vm2 information disclosure via util.getCallSites()","severity":"medium","exploited":false,"published_at":"2026-09-17T15:32:14+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-util-getcallsites-bypasses-ghsa-v27g-host-frame-d15f7df3"},{"cvss":10,"slug":"duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c","title":"vm2 HTTPS credentials exposure through globalAgent proxy bypass","severity":"critical","exploited":false,"published_at":"2026-09-17T15:32:14+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-exposes-host-https-credentials-and-tls-traffic-6a6b291c"},{"cvss":5.8,"slug":"duplicate-advisory-vm2-leaks-absolute-host-filesystem-paths-to-sandbox-a59ab86f","title":"vm2 information disclosure via error stack formatting","severity":"medium","exploited":false,"published_at":"2026-09-17T15:32:14+00:00","url":"https://junglewise.ai/threats/duplicate-advisory-vm2-leaks-absolute-host-filesystem-paths-to-sandbox-a59ab86f"},{"cve":"CVE-2026-92963","cvss":5.3,"epss":0.0034,"slug":"cve-2026-92963-vm2-internal-state-disclosure-in-computed-key-access","title":"vm2 has access to `VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL`","severity":"medium","exploited":false,"published_at":"2026-09-17T14:18:02.783+00:00","url":"https://junglewise.ai/threats/cve-2026-92963-vm2-internal-state-disclosure-in-computed-key-access"},{"cve":"CVE-2026-92962","cvss":4,"epss":0.0016,"slug":"cve-2026-92962-vm2-defense-invariant-11-violation-in-stack-trace-formatter","title":"vm2 Defense Invariant #11 violation in stack-trace formatter","severity":"medium","exploited":false,"published_at":"2026-09-17T14:18:02.61+00:00","url":"https://junglewise.ai/threats/cve-2026-92962-vm2-defense-invariant-11-violation-in-stack-trace-formatter"},{"cve":"CVE-2026-92959","cvss":7.1,"epss":0.0045,"slug":"cve-2026-92959-vm2-allowasync-bypass-via-promise-thenable-assimilation","title":"vm2 allowAsync bypass via Promise thenable assimilation","severity":"high","exploited":false,"published_at":"2026-09-17T14:18:02.13+00:00","url":"https://junglewise.ai/threats/cve-2026-92959-vm2-allowasync-bypass-via-promise-thenable-assimilation"},{"cve":"CVE-2026-92954","cvss":8.6,"epss":0.0049,"slug":"cve-2026-92954-vm2-host-promise-rejection-denial-of-service","title":"vm2 host Promise rejection denial of service","severity":"high","exploited":false,"published_at":"2026-09-17T14:18:01.32+00:00","url":"https://junglewise.ai/threats/cve-2026-92954-vm2-host-promise-rejection-denial-of-service"},{"cve":"CVE-2026-92953","cvss":10,"epss":0.005,"slug":"cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer","title":"vm2 prototype pollution in TypedArray and ArrayBuffer","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:01.16+00:00","url":"https://junglewise.ai/threats/cve-2026-92953-vm2-prototype-pollution-in-typedarray-and-arraybuffer"},{"cve":"CVE-2026-92952","cvss":6.8,"epss":0.0046,"slug":"cve-2026-92952-vm2-sandbox-symbol-filtering-bypass-in-node-js-symbol-isolation","title":"vm2 sandbox symbol filtering bypass in Node.js symbol isolation","severity":"medium","exploited":false,"published_at":"2026-09-17T14:18:00.987+00:00","url":"https://junglewise.ai/threats/cve-2026-92952-vm2-sandbox-symbol-filtering-bypass-in-node-js-symbol-isolation"},{"cve":"CVE-2026-92951","cvss":9.9,"epss":0.0054,"slug":"cve-2026-92951-vm2-module-allowlist-bypass-via-substring-matching","title":"vm2 module allowlist bypass via substring matching","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:00.827+00:00","url":"https://junglewise.ai/threats/cve-2026-92951-vm2-module-allowlist-bypass-via-substring-matching"},{"cve":"CVE-2026-92949","cvss":4,"epss":0.0032,"slug":"cve-2026-92949-vm2-sandbox-bypass-via-accessor-descriptor-on-frozen-objects","title":"vm2 sandbox bypass via accessor descriptor on frozen objects","severity":"medium","exploited":false,"published_at":"2026-09-17T14:18:00.463+00:00","url":"https://junglewise.ai/threats/cve-2026-92949-vm2-sandbox-bypass-via-accessor-descriptor-on-frozen-objects"},{"cve":"CVE-2026-92947","cvss":10,"epss":0.0048,"slug":"cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool","title":"vm2 memory disclosure via shared Buffer pool","severity":"critical","exploited":false,"published_at":"2026-09-17T14:18:00.14+00:00","url":"https://junglewise.ai/threats/cve-2026-92947-vm2-memory-disclosure-via-shared-buffer-pool"},{"cve":"CVE-2026-92946","cvss":10,"epss":0.0086,"slug":"cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external","title":"vm2 remote code execution in NodeVM require.external","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.963+00:00","url":"https://junglewise.ai/threats/cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external"},{"cve":"CVE-2026-92941","cvss":10,"epss":0.0029,"slug":"cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation","title":"vm2 NodeVM sandbox escape via TLS trust store manipulation","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.31+00:00","url":"https://junglewise.ai/threats/cve-2026-92941-vm2-nodevm-sandbox-escape-via-tls-trust-store-manipulation"},{"cve":"CVE-2026-92940","cvss":10,"epss":0.0047,"slug":"cve-2026-92940-vm2-https-credential-exposure-via-globalagent","title":"vm2 HTTPS credential exposure via globalAgent","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.143+00:00","url":"https://junglewise.ai/threats/cve-2026-92940-vm2-https-credential-exposure-via-globalagent"}],"vendor":{"hub":true,"name":"Patriksimek","slug":"patriksimek","url":"https://junglewise.ai/threats/vendors/patriksimek"},"weekly":[{"week":"2026-08-17","critical":2,"exploited":0,"vulnerabilities":3},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":14,"exploited":0,"vulnerabilities":27},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":1},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-92937","cvss":10,"epss":0.0103,"slug":"cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling","title":"vm2 sandbox escape in Promise rejection handling","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:58.517+00:00","url":"https://junglewise.ai/threats/cve-2026-92937-vm2-sandbox-escape-in-promise-rejection-handling"},{"cve":"CVE-2026-92946","cvss":10,"epss":0.0086,"slug":"cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external","title":"vm2 remote code execution in NodeVM require.external","severity":"critical","exploited":false,"published_at":"2026-09-17T14:17:59.963+00:00","url":"https://junglewise.ai/threats/cve-2026-92946-vm2-remote-code-execution-in-nodevm-require-external"},{"cve":"CVE-2026-47208","cvss":10,"epss":0.0083,"slug":"cve-2026-47208-patriksimek-vm2-sandbox-breakout-via-promise-species-hijack","title":"patriksimek vm2 sandbox breakout via Promise species hijack","severity":"critical","exploited":false,"published_at":"2026-06-12T15:16:28.767+00:00","url":"https://junglewise.ai/threats/cve-2026-47208-patriksimek-vm2-sandbox-breakout-via-promise-species-hijack"},{"cve":"CVE-2026-44005","cvss":10,"epss":0.0083,"slug":"cve-2026-44005-patriksimek-vm2-sandbox-escape-via-host-prototype-mutation","title":"patriksimek vm2 sandbox escape via host prototype mutation","severity":"critical","exploited":false,"published_at":"2026-05-13T18:16:17.257+00:00","url":"https://junglewise.ai/threats/cve-2026-44005-patriksimek-vm2-sandbox-escape-via-host-prototype-mutation"},{"cve":"CVE-2026-47140","cvss":10,"epss":0.0082,"slug":"cve-2026-47140-patriksimek-vm2-sandbox-escape-via-nodevm-builtin-denylist-bypass","title":"patriksimek vm2 sandbox escape via NodeVM builtin denylist bypass","severity":"critical","exploited":false,"published_at":"2026-06-12T15:16:28.4+00:00","url":"https://junglewise.ai/threats/cve-2026-47140-patriksimek-vm2-sandbox-escape-via-nodevm-builtin-denylist-bypass"},{"cve":"CVE-2026-44006","cvss":10,"epss":0.0077,"slug":"cve-2026-44006-patriksimek-vm2-sandbox-escape-via-arbitrary-prototype-access","title":"patriksimek vm2 sandbox escape via arbitrary prototype access","severity":"critical","exploited":false,"published_at":"2026-05-13T18:16:17.387+00:00","url":"https://junglewise.ai/threats/cve-2026-44006-patriksimek-vm2-sandbox-escape-via-arbitrary-prototype-access"},{"cve":"CVE-2026-43997","cvss":10,"epss":0.0077,"slug":"cve-2026-43997-patriksimek-vm2-sandbox-escape-via-host-object-leakage","title":"patriksimek vm2 sandbox escape via host object leakage","severity":"critical","exploited":false,"published_at":"2026-05-13T18:16:16.177+00:00","url":"https://junglewise.ai/threats/cve-2026-43997-patriksimek-vm2-sandbox-escape-via-host-object-leakage"},{"cve":"CVE-2026-93605","cvss":10,"epss":0.0073,"slug":"cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission","title":"vm2 NodeVM sandbox escape via child_process denylist omission","severity":"critical","exploited":false,"published_at":"2026-09-18T14:19:12.34+00:00","url":"https://junglewise.ai/threats/cve-2026-93605-vm2-nodevm-sandbox-escape-via-child-process-denylist-omission"},{"cve":"CVE-2026-93603","cvss":10,"epss":0.0073,"slug":"cve-2026-93603-vm2-sandbox-escape-via-nullish-this-receiver","title":"vm2 sandbox escape via nullish this receiver","severity":"critical","exploited":false,"published_at":"2026-09-18T14:19:12.003+00:00","url":"https://junglewise.ai/threats/cve-2026-93603-vm2-sandbox-escape-via-nullish-this-receiver"},{"cve":"CVE-2026-47137","cvss":10,"epss":0.0071,"slug":"cve-2026-47137-patriksimek-vm2-sandbox-escape-via-configuration-bypass","title":"patriksimek vm2 sandbox escape via configuration bypass","severity":"critical","exploited":false,"published_at":"2026-06-12T15:16:28.137+00:00","url":"https://junglewise.ai/threats/cve-2026-47137-patriksimek-vm2-sandbox-escape-via-configuration-bypass"}],"generated_at":"2026-11-09T03:07:00.176479+00:00","technologies":[{"name":"Patriksimek Vm2","slug":"patriksimek-vm2","vulnerabilities":29,"url":"https://junglewise.ai/threats/technologies/patriksimek-vm2"}]}