The vm2 sandbox library is vulnerable to a critical remote code execution flaw that permits an attacker to escape the sandbox environment and compromise the host system.

The vulnerability exists due to an incomplete fix for a previous sandbox bypass, specifically within the Promise rejection handling logic in lib/bridge.js. By utilizing Function.prototype.call or .apply indirection, an unauthenticated attacker can bypass sanitization routines and gain access to host-realm objects to execute arbitrary commands.

A successful exploit allows an attacker to achieve full remote code execution on the host server running the Node.js process. Given the CVSS score of 10.0, this represents the highest level of risk, potentially leading to total system compromise, unauthorized data exfiltration, and persistent access for malicious actors.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later immediately.

Proactive Monitoring: Monitor server logs for unusual child process creation or unexpected system calls originating from the Node.js environment.

Compensating Controls: If immediate patching is not feasible, restrict the use of async host functions bridged into the sandbox or implement strict process-level sandboxing to limit the impact of a potential escape.

Public Exploit Available: Unknown.

This vulnerability presents a critical risk to any infrastructure utilizing the vm2 library for sandboxing untrusted code. Given the ease of exploitation through promise-based indirection, organizations must prioritize upgrading to version 3.11.7. Failure to patch will leave the host process susceptible to full administrative control by an attacker.