The patriksimek vm2 Node.js sandbox prior to version 3.11.0 contains a code injection vulnerability (CWE-94) due to improper control over the generation of code. Specifically, it is possible to access BaseHandler.getPrototypeOf, which allows an attacker to obtain arbitrary prototypes. This flaw can be exploited remotely without authentication or user interaction, resulting in a critical security impact. The vulnerability is addressed by updating to vm2 version 3.11.0.

Successful exploitation of this vulnerability can lead to full compromise of the sandbox environment, allowing an attacker to execute arbitrary code with the privileges of the Node.js process. This impacts confidentiality, integrity, and availability of the affected system. Given the CVSS 3.1 score of 10.0, the vulnerability is critical and poses a severe risk if exploited.

A fix is available by upgrading vm2 to version 3.11.0 or later. Since the vendor advisory or patch links are not explicitly provided, users should verify the update from the official patriksimek vm2 repository or trusted sources. Patch status is not yet confirmed by a vendor advisory in this data; therefore, users should check the vendor's official channels for the latest remediation guidance.