A critical sandbox escape vulnerability in the patriksimek vm2 library allows unauthenticated attackers to achieve arbitrary host command execution.

This vulnerability is a sandbox escape flaw stemming from improper control of dynamically managed code resources (CWE-913). By leveraging stacked indirection through Function.prototype.call, an unauthenticated attacker can manipulate host intrinsic prototypes to execute arbitrary code on the host system.

The ability to escape a sandbox environment and execute arbitrary host commands represents a total compromise of the host system. Given the CVSS score of 9.8, this vulnerability poses an extreme risk to data confidentiality, integrity, and availability, potentially leading to full system takeover and lateral movement within the network.

Immediate Action: Update the patriksimek vm2 library to version 3.11.6 or later immediately.

Proactive Monitoring: Review application logs for unusual sandbox behavior or execution attempts involving internal prototype chain modifications.

Compensating Controls: Since this is a library-level vulnerability, ensure that the application is running with the principle of least privilege, minimizing the impact if the host is compromised.

Public Exploit Available: Unknown.

This vulnerability is highly critical and requires immediate attention. Organizations utilizing vm2 to sandbox untrusted code must prioritize the upgrade to version 3.11.6 to prevent potential remote code execution and full host compromise.