patriksimek has 34 CVEs on record. Disclosure cadence is accelerating: 34 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 34. The median CVSS is 9.9 (critical), with 20 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-693 (9) and CWE-913 (4).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 9.9
- Publish → KEV
- —
- Last 90 days
- 34 prev 0
Worst active — by depth score
CVE-2026-93606Critical· 10.0vm2 (npm) versions 3.12.0 and earlier contain a sandbox escape in `VM` and `NodeVM`67CVE-2026-92960Critical· 10.0vm2 before 3.11.6 fails to restrict access to os and dns builtins under the builtin: ['*'] configuration, allowing sandbox code to read host process identity and network topology67CVE-2026-92957Critical· 9.9vm2 through 3.11.6 does not normalize `node:`-prefixed builtin specifiers when evaluating user-supplied negative (deny) entries in a NodeVM wildcard require policy67CVE-2026-92955Critical· 10.0vm2 before 3.11.8 contains a sandbox escape vulnerability in NodeVM that allows attackers to access the host __proto__ getter/setter through console._stdout and console._stderr67CVE-2026-92953Critical· 10.0vm2 versions from 3.11.0 before 3.11.8 fail to protect host TypedArray and ArrayBuffer prototypes from sandbox mutation67
patriksimek vulnerabilities
CVEs affecting patriksimek, newest first. Open any entry for full detail, references, and exploit status.
34 CVEsRSS
CVE-2026-92936Medium· 5.8PoCvm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting
vm2 versions 3.11.0 through 3.11.6 leak absolute host filesystem paths to sandboxed code through error stack formatting. Attacker-supplied code can force the host-realm source transformer to throw a SyntaxError (for example by calling ev…
CVE-2026-92935Critical· 9.0vm2 is a sandbox for running untrusted Node.js code
vm2 is a sandbox for running untrusted Node.js code. In versions >= 3.11.4 and <= 3.11.6, the NodeVM constructor computes `hasRealRequireConfig` with `typeof requireOpts === 'object' && requireOpts !== null`, so an array-shaped `require`…
CVE-2026-92934Critical· 9.0PoCvm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal
vm2 before 3.11.8 contains an incomplete fix for Error.cause sanitization that allows sandbox escape when revisited host-wrapped AggregateError objects are caught within a single exception handler traversal. Attackers can exploit cycle d…
CVE-2026-92933Medium· 5.8PoCvm2 is a sandbox for running untrusted Node.js code
vm2 is a sandbox for running untrusted Node.js code. In versions <= 3.11.7, NodeVM exposes the host `util` module to the sandbox as an unfiltered shallow copy (`Object.assign({}, util)` in `defaultBuiltinLoaderUtil`), and the deprecated …