A critical vulnerability in the vm2 library allows unauthenticated attackers to escape the sandbox, potentially hijacking host DNS resolution and exposing sensitive system information.

This is an information exposure and sandbox escape vulnerability (CWE-200) occurring when the library is configured with builtin: ['*']. An unauthenticated attacker can invoke restricted builtins to manipulate host process state, specifically by hijacking DNS queries.

The exploitation of this vulnerability poses a severe threat to the integrity and confidentiality of any application utilizing the vm2 sandbox. By redirecting host DNS traffic, an attacker can perform man-in-the-middle attacks on outgoing connections, leading to the interception of sensitive data or the delivery of malicious payloads. Given the CVSS score of 10.0, this represents a critical risk that could lead to a total compromise of the host environment.

Immediate Action: Update the npm package vm2 to version 3.11.6 or later to enforce proper restriction of sensitive builtins.

Proactive Monitoring: Monitor server logs for unexpected outbound DNS activity or anomalies in process behavior originating from the sandbox environment.

Compensating Controls: If immediate patching is not possible, restrict the use of the builtin: ['*'] configuration and implement network-level egress filtering to prevent unauthorized DNS redirection.

Public Exploit Available: No (as of Sep 17, 2026, there is no confirmed weaponized exploit; enrichment data does not indicate a Metasploit module or ExploitDB entry).

Organizations utilizing the vm2 library must prioritize updating to version 3.11.6 immediately. The ability for an unauthenticated attacker to manipulate host DNS resolution represents a complete failure of the sandbox boundary, necessitating urgent intervention to prevent potential full-system compromise.