The vm2 library for Node.js versions before 3.11.0 contains a vulnerability that permits sandboxed code to access the host Object, for example via HostObject.getOwnPropertySymbols and Symbol(nodejs.util.inspect.custom). This access enables sandbox escape and arbitrary code execution on the host process. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code) and CWE-653 (Improper Isolation or Compartmentalization). It has a CVSS v3.1 base score of 10.0 (critical) with network attack vector, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The issue is fixed in vm2 version 3.11.0. Red Hat advisory confirms the vulnerability and the fix in 3.11.0 but does not provide an official patch for their products yet.

An unauthenticated remote attacker who can submit code to a vm2 sandbox can exploit this vulnerability to escape the sandbox and execute arbitrary code on the host system. This results in a complete compromise of the host, affecting confidentiality, integrity, and availability.

A fix is available in vm2 version 3.11.0. Users should upgrade to version 3.11.0 or later to remediate this vulnerability. The Red Hat advisory confirms the fix in vm2 3.11.0 but does not indicate an official patch release for Red Hat products yet. Patch status is not yet confirmed for Red Hat products — check the vendor advisory for current remediation guidance.