The vm2 sandbox environment is vulnerable to a critical remote code execution flaw that permits an authenticated attacker to escape the sandbox and execute arbitrary native code on the host system.

This vulnerability occurs due to a protection mechanism failure (CWE-693) where the node:sqlite module is improperly exposed to sandboxed code. An authenticated attacker can bypass security restrictions to load malicious native libraries, leading to full host-level code execution.

The ability for an attacker to break out of a sandboxed environment and execute code on the underlying host represents a total compromise of the application server. Given the CVSS score of 9.9, this vulnerability poses an extreme risk, as it allows for unauthorized data access, lateral movement within the network, and complete system takeover.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later to resolve the sandbox escape mechanism.

Proactive Monitoring: Monitor application logs for unexpected native module loading or unusual process spawning behavior originating from within the NodeVM environment.

Compensating Controls: Restrict the use of built-in modules in the vm2 configuration, specifically ensuring node:sqlite is not permitted, until the update can be applied.

Public Exploit Available: Unknown

Due to the critical severity and the potential for full host compromise, organizations utilizing the vm2 library must prioritize updating to version 3.11.7 immediately. Failure to apply this update leaves the host infrastructure exposed to arbitrary code execution by any actor capable of triggering sandboxed code.