The vm2 Node.js sandbox prior to version 3.11.1 contains an improper access control vulnerability (CWE-284) when NodeVM instances are created with nesting: true. In this configuration, sandboxed code can unconditionally require the 'vm2' module regardless of the outer VM's require configuration, including when require is disabled. This access allows the sandbox to instantiate an inner NodeVM with unrestricted require permissions, leading to arbitrary OS command execution on the host system. This vulnerability results in a complete compromise of the host environment for applications running untrusted code in nested NodeVMs. The issue is fixed in vm2 version 3.11.1.

Successful exploitation allows sandboxed code to bypass intended module loading restrictions and execute arbitrary operating system commands on the host. This leads to full compromise of the host application environment when untrusted code is run inside a nested NodeVM. The CVSS v3.1 score is 9.1 (critical), reflecting network attack vector, low attack complexity, high privileges required, no user interaction, and complete confidentiality, integrity, and availability impact.

Upgrade vm2 to version 3.11.1 or later, where this vulnerability is fixed. Applications running untrusted code inside NodeVM instances with nesting enabled should apply this update to prevent exploitation. Patch status is confirmed fixed in 3.11.1. No other mitigations are indicated by the vendor advisory.