A critical sandbox escape vulnerability in the patriksimek vm2 library allows unauthenticated remote attackers to achieve full system command execution.

This is a sandbox escape vulnerability (CWE-693) occurring because the DANGEROUS_BUILTINS denylist fails to include the child_process module. An unauthenticated attacker can leverage this oversight to bypass sandbox restrictions and execute arbitrary commands on the underlying host system.

A successful exploit grants an attacker full control over the host environment, leading to total system compromise, data exfiltration, and potential lateral movement within the network. With a CVSS score of 10.0, this vulnerability represents the highest level of risk, as it allows for trivial remote code execution without requiring any prior authentication or user interaction.

Immediate Action: Update the patriksimek vm2 dependency to version 3.12.1 or later immediately.

Proactive Monitoring: Inspect application logs for unusual child process spawns or unexpected execution of system-level commands originating from the vm2 sandbox environment.

Compensating Controls: If immediate patching is not feasible, ensure the vm2 configuration does not use builtin:['*'] and explicitly deny access to the child_process module until the update can be applied.

Public Exploit Available: Unknown

The severity of this vulnerability cannot be overstated, as it allows unauthenticated remote code execution. Organizations utilizing the vm2 library must prioritize updating to version 3.12.1 or later to mitigate the risk of host system compromise. Failure to patch this dependency leaves the host environment exposed to trivial exploitation.