A critical sandbox escape vulnerability in the vm2 library allows for full remote code execution on the host machine, posing an immediate risk to any application utilizing this sandboxing solution.

The vulnerability exists within the library's bridge component, which fails to correctly sanitize the this receiver when sandboxed code calls host-provided, non-strict functions. This oversight allows an unauthenticated attacker to gain a reference to the host global object and subsequently execute arbitrary commands via the process module.

This vulnerability carries a CVSS score of 10.0, representing the highest level of severity. Successful exploitation results in a complete compromise of the host environment, enabling attackers to steal sensitive data, modify system configurations, or deploy malware across the infrastructure. The potential for total system takeover necessitates immediate attention to prevent severe operational and reputational damage.

Immediate Action: Update the vm2 library to version 3.12.1 or higher immediately to apply the necessary security fixes.

Proactive Monitoring: Review application logs for unusual child process creation or unexpected access to the process global object originating from sandboxed execution contexts.

Compensating Controls: Audit current codebases to ensure all host-provided functions exposed to the vm2 sandbox are explicitly defined in strict mode, as these are not susceptible to this specific exploit vector.

Public Exploit Available: No (exploit_available: false)

This vulnerability is critical due to its ability to bypass primary security boundaries in sandboxed environments. Organizations currently using vm2 must prioritize upgrading to version 3.12.1 to neutralize the risk of remote code execution. Given the ease with which this sandbox escape can be triggered, administrators should treat this update as a high-priority maintenance task.