A critical sandbox escape vulnerability in the vm2 library allows unauthenticated attackers to achieve full remote code execution on the host system.

This is a sandbox escape vulnerability (CWE-693) occurring when running on Node.js 26, where an unauthenticated attacker can manipulate WebAssembly streams to access the host process object and execute arbitrary code.

Successful exploitation grants an attacker complete control over the host environment, bypassing all intended sandbox restrictions. Given the CVSS score of 10.0, this represents the highest level of risk, potentially leading to total system compromise, data exfiltration, and lateral movement within the network.

Immediate Action: Update the patriksimek vm2 library to version 3.11.7 or later to implement the necessary sandbox protections.

Proactive Monitoring: Review application logs for unusual WebAssembly compilation patterns or attempts to access restricted host modules such as fs.

Compensating Controls: Since this is a library level vulnerability, ensure that applications using vm2 are executed within highly restricted container environments with minimal host access permissions to limit the blast radius.

Public Exploit Available: No

This vulnerability presents a maximum-severity risk to any application relying on vm2 for code isolation. Security teams should prioritize the update to version 3.11.7 immediately to prevent potential remote code execution attacks against their infrastructure.