A critical sandbox escape vulnerability in the patriksimek vm2 library allows unauthenticated attackers to manipulate host prototypes and compromise the integrity of the host environment.

This vulnerability, categorized as CWE-913, involves the improper control of dynamically managed code resources where the sandbox fails to protect host TypedArray and ArrayBuffer prototypes. Unauthenticated attackers can exploit this by using prototype walking primitives to reach and modify host prototypes, thereby influencing objects outside the sandbox environment.

The potential for a sandbox escape represents a critical security failure, as it allows an attacker to bypass isolation boundaries and execute arbitrary code or influence operations within the host process. Given the CVSS score of 10.0, this flaw poses an extreme risk to any application relying on vm2 for secure code execution, potentially leading to total system compromise, data theft, and unauthorized manipulation of host-level resources.

Immediate Action: Update the patriksimek vm2 library to version 3.11.8 or later to ensure host prototypes are correctly isolated from sandbox mutations.

Proactive Monitoring: Review application logs for unusual sandbox behavior or unexpected modifications to global objects, and monitor for increased CPU or memory usage that may indicate exploitation attempts.

Compensating Controls: While no direct virtual patch exists, implement strict input validation and resource constraints to limit the ability of untrusted code to interact with sensitive APIs.

Public Exploit Available: exploit_available (false / unknown)

Due to the critical nature of this sandbox escape vulnerability, organizations must prioritize upgrading to version 3.11.8 immediately. Failure to remediate this flaw leaves the host environment susceptible to full compromise by any unauthenticated attacker capable of executing code within the vm2 sandbox.