A critical remote code execution vulnerability in the vm2 sandbox library allows unauthenticated attackers to escape the sandbox and execute arbitrary host OS commands.

This vulnerability occurs when the require.external feature is enabled without an explicit require.root configuration. An unauthenticated attacker can force the sandbox to require the vm2 package itself, instantiate an unrestricted NodeVM instance, and execute arbitrary commands via the child_process module.

Successful exploitation of this vulnerability results in a total compromise of the host system, potentially leading to unauthorized data exfiltration, lateral movement within the network, and complete loss of system integrity. Given the CVSS score of 10.0, this flaw represents the highest level of risk, as it is network-exploitable, requires no authentication, and involves no user interaction.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later to incorporate the security fix.

Proactive Monitoring: Monitor application logs for attempts to require unexpected internal packages or suspicious spawning of shell processes from within the sandbox environment.

Compensating Controls: If immediate patching is not feasible, disable the require.external feature in the vm2 configuration or restrict require.root to a strictly controlled directory that excludes the node_modules folder.

Public Exploit Available: Unknown.

The severity of this vulnerability cannot be overstated, as it grants full system control to an unauthenticated attacker. Organizations utilizing the vm2 library must prioritize updating to version 3.11.7 immediately to mitigate the risk of remote code execution. Failure to apply this update leaves the host infrastructure exposed to trivial exploitation.