A critical sandbox escape vulnerability in the patriksimek vm2 library allows unauthenticated attackers to execute arbitrary code on the host system, necessitating an immediate update.

This is a sandbox escape flaw (CWE-913) occurring within the NodeVM component where attackers can access host prototype properties through console output streams. By overwriting event emitters, an unauthenticated attacker can bypass code generation restrictions to execute malicious code within the process context.

The potential for full system compromise makes this vulnerability extremely severe, justifying its CVSS score of 10.0. Successful exploitation grants an attacker the ability to execute arbitrary commands on the host server, which can lead to complete data exfiltration, unauthorized access to internal networks, and total loss of system integrity.

Immediate Action: Update the patriksimek vm2 package to version 3.11.8 or later immediately to incorporate the necessary sandbox protections.

Proactive Monitoring: Review application logs for unusual console output patterns or unexpected process events that may indicate attempts to manipulate the NodeVM environment.

Compensating Controls: Implement strict environment isolation and principle of least privilege for any services utilizing vm2, and consider sandboxing the entire application process at the container or operating system level to limit the scope of a potential escape.

Public Exploit Available: Unknown.

Given the critical severity of this sandbox escape and the availability of proof-of-concept evidence, organizations using vm2 must prioritize this update in their current maintenance cycle. Failure to patch allows attackers to bypass core security controls and gain full control over the underlying host. Patching to version 3.11.8 is the only definitive way to close this security gap.