The vulnerability in patriksimek vm2 prior to version 3.11.8 stems from an incomplete fix related to Error.cause sanitization. When host-wrapped AggregateError objects are revisited within a single exception handler traversal, attackers can exploit a cycle detection bypass in the handleException function. This allows access to unsanitized host proxies embedded in the errors array, effectively enabling sandbox escape. The impact includes full remote code execution and process information disclosure from the sandboxed environment.

Successful exploitation allows an attacker to escape the sandbox environment, execute arbitrary code remotely, and disclose sensitive process information. This compromises the security guarantees of the vm2 sandbox, potentially leading to full system compromise.

A fix is available in patriksimek vm2 version 3.11.8. Users should upgrade to version 3.11.8 or later to remediate this vulnerability. No additional mitigation steps are indicated beyond applying the official patch.