The vm2 sandbox library is vulnerable to a critical sandbox escape and remote code execution flaw that allows attackers to execute arbitrary native code on the host process.

This vulnerability, categorized as CWE-114 (Process Control), occurs because the NodeVM sandbox fails to restrict host-process authority for the crypto module. An authenticated attacker can invoke crypto.setEngine() with a malicious path to trigger the execution of native code via the operating system dynamic loader.

Successful exploitation leads to a complete sandbox escape, granting an attacker full control over the host process. Given the CVSS score of 9.9, this represents a critical risk that could lead to full system compromise, data theft, and unauthorized persistence within the infrastructure.

Immediate Action: Update the patriksimek vm2 package to version 3.11.7 or higher immediately to apply the necessary security constraints on the crypto module.

Proactive Monitoring: Audit applications using vm2 for calls to the crypto module, specifically monitoring for unusual filesystem access or unexpected dynamic library loading patterns.

Compensating Controls: If immediate patching is not feasible, restrict the availability of the crypto builtin within NodeVM configurations to prevent access to the vulnerable setEngine functionality.

Public Exploit Available: Unknown.

This vulnerability poses a severe threat to any environment relying on vm2 for process isolation. Security teams should prioritize updating to version 3.11.7 across all development and production environments. Failure to address this flaw could result in a total compromise of the host environment, making immediate remediation essential.