The vm2 sandbox for Node.js, specifically version 3.10.4, contains a protection mechanism failure (CWE-693) that enables an attacker running code inside VM.run() to escape the sandbox environment. This escape allows the attacker to access the host process object and execute arbitrary commands on the host system without requiring any cooperation from the host. This vulnerability is addressed in vm2 version 3.10.5, which patches the sandbox escape issue.

Successful exploitation results in full sandbox escape and arbitrary code execution on the host system. This compromises the confidentiality, integrity, and availability of the host environment where vm2 is used, potentially allowing an attacker to run any commands with the privileges of the host process running vm2.

Upgrade vm2 to version 3.10.5 or later, where this vulnerability is patched. Since this is a self-hosted library and not a cloud service, users must apply the update themselves. Patch status is confirmed by the vendor's versioning information indicating the fix in 3.10.5.