A critical sandbox escape vulnerability in the vm2 library permits remote attackers with low privileges to achieve full remote code execution on the host operating system.

This flaw involves a failure in the sandbox protection mechanism where the node:test builtin module is incorrectly exposed to the sandbox. An authenticated attacker can leverage this to spawn an unrestricted host process, leading to arbitrary JavaScript execution outside the intended sandbox environment.

The vulnerability carries a CVSS score of 9.9, reflecting its potential for a complete compromise of the host system. Successful exploitation allows an attacker to bypass all sandbox restrictions, leading to unauthorized data access, complete system takeover, and potential lateral movement within the network. Given the critical nature of this flaw, immediate remediation is required to prevent catastrophic security failures.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later to implement the necessary fix for the sandbox bypass.

Proactive Monitoring: Monitor server logs for unusual process spawning or unexpected child process execution, particularly involving the node:test module.

Compensating Controls: If immediate patching is not feasible, restrict the use of the node:test builtin within the NodeVM configuration or disable the library in environments where untrusted code execution is required.

Public Exploit Available: No

The severity of this vulnerability cannot be overstated, as it represents a total failure of the primary security feature of the vm2 product. Administrators must prioritize updating to version 3.11.7 immediately to close this critical gap. Failure to act leaves the host infrastructure vulnerable to complete compromise by any user capable of executing code within the sandbox.