A critical memory isolation vulnerability in the vm2 library allows unauthenticated attackers to escape the sandbox and access host memory, potentially leading to full system compromise.

This vulnerability is a sandbox escape flaw involving the exposure of the host Node.js shared Buffer pool to untrusted code. By manipulating small allocations, an unauthenticated attacker can acquire host-realm ArrayBuffers to read or write sensitive data.

The ability to read and write host-realm memory from within a sandboxed environment represents a total loss of security boundaries. This can lead to the exfiltration of sensitive host data, credential theft, or the execution of arbitrary code on the underlying server, justifying the maximum CVSS score of 10.0. Organizations relying on vm2 for isolating untrusted user input are at immediate risk of full system compromise.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later to implement the necessary memory isolation fixes.

Proactive Monitoring: Review application logs for unusual memory allocation patterns or attempts to invoke Buffer operations from within sandboxed execution contexts.

Compensating Controls: If an immediate update is not feasible, restrict the execution of untrusted code entirely or move sensitive processing to a more robust, hardware-level containerization solution.

Public Exploit Available: Unknown.

Given the critical nature of this sandbox escape and the confirmed technical impact, immediate remediation is required. Administrators should prioritize upgrading the vm2 package to 3.11.7 across all development and production environments to restore proper memory isolation and prevent unauthorized host access.