A critical sandbox escape vulnerability in the vm2 library allows unauthenticated attackers to execute arbitrary code on the host, necessitating an immediate update to version 3.12.1.

This is a Protection Mechanism Failure (CWE-693) where the sandbox bridge fails to properly sanitize host-realm Promises. An unauthenticated attacker can manipulate the Promise constructor to bypass security controls and gain access to host objects, leading to arbitrary code execution.

The exploitation of this vulnerability results in a total compromise of the host environment, as the attacker escapes the sandbox to execute arbitrary code. Given the CVSS score of 10.0, this poses a maximum risk to data confidentiality, integrity, and availability. Organizations relying on vm2 for process isolation face imminent risk of complete system takeover and potential lateral movement within the network.

Immediate Action: Update the patriksimek vm2 package to version 3.12.1 or later to implement the necessary security patches in the bridge logic.

Proactive Monitoring: Review application logs for unexpected attempts to access host-level objects or unusual execution patterns originating from within the sandboxed environment.

Compensating Controls: While no direct WAF rule can stop this internal logic flaw, ensure the principle of least privilege is applied to the process running the vm2 sandbox to limit the impact of a successful escape.

Public Exploit Available: Unknown.

This vulnerability represents a critical security failure in the vm2 library that enables full system compromise. Organizations must prioritize the transition to version 3.12.1 immediately to eliminate the possibility of sandbox escapes. Failure to patch this flaw leaves the host environment exposed to unauthenticated remote code execution attacks.