A critical vulnerability in the vm2 library allows sandboxed code to bypass security boundaries and compromise host process credentials, requiring an immediate update to version 3.11.7.

This is an exposure of resource to the wrong sphere (CWE-668) where the https.globalAgent is improperly exposed to sandboxed code. An unauthenticated attacker can register listeners for host events to intercept sensitive Authorization headers and initiate authenticated requests on behalf of the host process.

The vulnerability carries a CVSS score of 10.0, indicating the highest level of severity. Successful exploitation allows for complete compromise of host-level confidentiality and integrity, as attackers can steal sensitive credentials and perform unauthorized actions within the host environment. This poses a severe risk of data exfiltration and secondary attacks against internal infrastructure.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later to implement the necessary security fix.

Proactive Monitoring: Review application logs for unusual outbound HTTPS requests or unexpected registration of event listeners within NodeVM instances.

Compensating Controls: If immediate patching is not feasible, restrict the use of require('https') within NodeVM configurations to prevent the vulnerable code path from being triggered.

Public Exploit Available: No (exploit_available: unknown)

Given the critical CVSS score of 10.0, this vulnerability must be treated as a priority. Organizations utilizing the vm2 library in environments where untrusted code is executed must upgrade to version 3.11.7 immediately to prevent sandbox escape and subsequent host compromise.