A critical security flaw in the vm2 library allows unauthenticated attackers to compromise the host TLS trust store, enabling man-in-the-middle attacks and complete bypass of secure communication protocols.

This vulnerability involves the improper exposure of the host tls module to the NodeVM sandbox, which allows unauthenticated code execution to modify certificate authorities. By invoking the tls.setDefaultCACertificates() function, an attacker can force the host environment to trust malicious certificates.

The ability to manipulate the host certificate authority store grants an attacker the power to intercept, decrypt, and modify encrypted traffic originating from the host system. Given the CVSS score of 10.0, this represents a total compromise of confidentiality and integrity for all applications relying on the affected vm2 sandbox. Such an exploit could lead to the theft of sensitive credentials, session tokens, and proprietary data, posing a severe risk to organizational operations and regulatory compliance.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later to ensure the host tls module is correctly sandboxed.

Proactive Monitoring: Monitor application logs for unexpected calls to TLS-related modules or anomalous outbound connection attempts that may indicate attempts to leverage intercepted traffic.

Compensating Controls: While a Web Application Firewall cannot directly patch this sandbox escape, strict egress filtering on the host can help limit the impact of an attacker attempting to establish unauthorized connections using spoofed certificates.

Public Exploit Available: Unknown

This vulnerability is critical and requires immediate attention due to the potential for total system compromise. Organizations utilizing the vm2 library must prioritize the upgrade to version 3.11.7, as the current flaw allows for trivial manipulation of the host trust store. Failure to patch leaves the underlying host environment and all associated network communications vulnerable to sophisticated interception attacks.