vm2 is an open source sandbox for Node.js environments. Versions prior to 3.11.2 contain a sandbox escape vulnerability categorized under CWE-668 (Exposure of Resource to Wrong Sphere) and CWE-653 (Improper Isolation or Compartmentalization). This vulnerability enables remote unauthenticated attackers who can submit code to the vm2 sandbox to escape isolation and execute arbitrary commands on the host system. The vulnerability has a CVSS v3.1 base score of 9.8, indicating critical severity with network attack vector, low complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. The issue is fixed in vm2 version 3.11.2. Red Hat has published an advisory confirming the vulnerability and the fix.

Successful exploitation allows remote attackers to bypass sandbox isolation and execute arbitrary code on the host system with the privileges of the sandbox process. This compromises confidentiality, integrity, and availability of the host. No privileges or user interaction are required for exploitation, making it highly severe.

Upgrade vm2 to version 3.11.2 or later, where this vulnerability is fixed. No other mitigations are indicated by the vendor advisory. Users should apply the official fix promptly to prevent exploitation.