A critical sandbox escape in the vm2 library allows attackers to break out of the virtual environment and execute arbitrary commands on the host system.

The vulnerability exists in the handleException function, which fails to properly sanitize the Error.cause property. An attacker can leverage this failure to obtain references to powerful host objects, such as the process object, enabling the execution of arbitrary host-level commands.

This flaw effectively nullifies the security benefits of the sandbox, allowing for full host compromise. Given the prevalence of vm2 in Node.js applications, this could lead to widespread data breaches, unauthorized server access, and complete system takeover. The 9.9 CVSS score reflects the extreme risk associated with a successful sandbox escape.

Immediate Action: Update the vm2 dependency to version 3.11.6 or later immediately. Verify that all downstream applications have successfully integrated the patched library version.

Proactive Monitoring: Monitor for unusual child process spawns or unauthorized file system access originating from the Node.js application process. Review application logs for unexpected error patterns.

Compensating Controls: Implement strict OS-level sandboxing (e.g., containers, gVisor, or restricted user accounts) to limit the potential impact if the application sandbox is bypassed.

Public Exploit Available: No (exploit_available: false)

The severity of a sandbox escape cannot be overstated, as it represents a fundamental breach of trust in the application security architecture. Development teams must prioritize this update to ensure the integrity of their Node.js environments.