A critical sandbox escape vulnerability in the vm2 CLI tool permits unauthenticated attackers to achieve full remote code execution on the host Node.js environment.

This vulnerability is a sandbox escape flaw in the vm2 CLI tool. It allows an attacker to supply a malicious script that bypasses isolation, enabling access to host modules such as fs and child_process.

Successful exploitation of this vulnerability results in full system compromise, as the attacker can execute arbitrary code within the host operating system. Given the CVSS score of 8.6, this represents a severe risk that could lead to complete data theft, unauthorized system control, and significant operational disruption.

Immediate Action: Upgrade the vm2 package to version 3.11.7 or later to incorporate the necessary security fixes.

Proactive Monitoring: Monitor system logs for unusual process executions or unauthorized access to sensitive file system modules originating from the Node.js runtime.

Compensating Controls: Implement strict input validation for any scripts passed to the CLI and run the utility within a hardened container or isolated environment to minimize the impact of a potential escape.

Public Exploit Available: Unknown

The severity of this flaw necessitates immediate attention. Organizations utilizing the vm2 CLI tool must prioritize upgrading to version 3.11.7 to eliminate the sandbox escape vector. Failure to patch allows attackers to break out of the intended security constraints, leading to full host compromise.